Mount Execution With Hidepid Parameter
Detects the execution of the 'mount' command with the 'hidepid=2' option. This parameter is used to hide processes from other users on the system, which can be leveraged by adversaries for defense evasion by making their malicious processes less visible.
Sigma
