Linux Mount Bind From Temp Into System Paths
Detects mount(8) bind operations from writable temp directories onto sensitive system subtrees, sometimes used to bypass integrity expectations or overlay binaries.
Sigma

Detects mount(8) bind operations from writable temp directories onto sensitive system subtrees, sometimes used to bypass integrity expectations or overlay binaries.

Already have an account?