Bind Mount Created to Obscure Malware Path

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the string "mount --bind" within TCP traffic on port 22 (SSH). This string indicates an attempt to create a bind mount, which can be used by attackers to obscure the true location of malicious files or to manipulate file system access. The rule specifically looks for this activity on the home network, suggesting an internal system being targeted or used for malicious purposes.