Mount Execution With Hidepid Parameter

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•1•0•1

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system