0012-mounts-add - New Path Mounted¶

Rule ID¶

• 0012-mounts-add

Category¶

• storage

Level¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitor new paths mounted on the host

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• A bind mount is another view of the relevant directory tree. Typically, a mount creates a tree-like view of a storage device. A bind mount, on the other hand, copies an existing directory tree to another mount point. The directories and files obtained through a bind mount are identical to the original ones; any changes made from either the mount directory or the original directory are immediately reflected on the other side. In simple terms, any mount point, ordinary directory, or file can be mounted elsewhere. If maliciously mounted, it can lead to risks such as data leakage.

Risk Items¶

• Data Leakage

• Network Security

Audit Method¶

• Verify that a new path has been mounted. You can run the following command to verify:

mount

Remediation¶

• If a new path is maliciously mounted, be sure to carefully inspect the host environment to prevent data leakage.

Impact¶

• None

Default Value¶

• None

References¶

• Emergency Response Ideas and Processes for Hacker Intrusion (Unofficial)

• Record of a Real Mining Intrusion Investigation and Analysis (Unofficial)

CIS Controls¶

• None