Sigma rule: Special File Creation via Mknod Syscall

Rule

Title

Special File Creation via Mknod Syscall

Status

experimental

Level

low

Author

Milad Cheraghi

Date

2025-05-31

Modified

2025-12-05

File

rules/linux/auditd/syscall/lnx_auditd_susp_special_file_creation_via_mknod_syscall.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.

Log source

product

linux

service

auditd

Detection

selection:
    type: 'SYSCALL'
    SYSCALL: 'mknod'
condition: selection

False positives (as the rule lists them)

• Device creation by legitimate scripts or init systems (udevadm, MAKEDEV)
• Container runtimes or security tools during initialization

Tags

• attack.privilege-escalation
• attack.persistence
• attack.t1543.003

MITRE ATT&CK ids this rule names

• T1543.003

References

• https://man7.org/linux/man-pages/man2/mknod.2.html
• https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/auditd/syscall/lnx_auditd_susp_special_file_creation_via_mknod_syscall.yml