Special File Creation via Mknod Syscall
Detects the use of the `mknod` syscall to create special files (e.g., character or block devices) on Linux systems. This syscall is rarely used by legitimate applications and can be abused by attackers or malware to create fake devices, interact with kernel interfaces, establish covert channels, bypass file system restrictions, or create backdoors.
Sigma
