KV Botnet ActivityC0035 ↗
Leveraged a bind mount to bind itself to the /proc/ file path before deleting its files from the /tmp/ directory.1
- Tactic
- Stealth
- Platform
- Linux
- Version
- 2.0
- Created
- 30 January 2025
- Last modified
- 12 May 2026
- Contributor
- Lê Phương Nam, Group-IB
Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.0
Tools & malwareNone recorded
Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Bind Mounts MITRE reference T1564.013
72nd pctamong all ATT&CK techniques for number of campaigns
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
All 1 campaigns for this technique
Offense vs defense T1564.013
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Bind Mounts detection strategy DET0428
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection Strategy for Bind Mounts on Linux
1 platform
AN1196 · Linux
Abuse of bind mounts to obscure process directories. Defender perspective: detecting anomalous mount operations where a process’s /proc entry is remapped to another directory, often hiding malicious activity from native utilities (ps, top). Behavior chain includes: (1) execution of mount with -o bind or -B flags, (2) modification of /proc entries inconsistent with expected process lineage, and (3) subsequent anomalous activity from processes whose metadata no longer matches execution context.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | auditd:SYSCALL | mount system call with bind or remap flags |
| Process MetadataDC0034 | linux:osquery | process metadata mismatch between /proc and runtime attributes |
| File CreationDC0039 | auditd:PATH | mount target path within /proc/* |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| BindMountFlags | Flags or options used in mount commands (e.g., -o bind, -B). Can vary across distributions and kernels. |
| WatchedProcPaths | List of /proc paths to monitor. Tunable to reduce noise from benign bind mounts used in containers or chroot environments. |
| CorrelationWindow | Timeframe to correlate bind mount creation with anomalous process or file activity. |