0013-mounts-del-Path Unmounted¶

Rule ID¶

• 0013-mounts-del

Category¶

• storage

Severity¶

• warn

Compatible Versions¶

• Linux

Description¶

• Monitors whether a host path is unmounted

Scan Frequency¶

• 1 */5 * * *

Rationale¶

• A bind mount is another view of an associated directory tree. Typically, a mount creates a tree view for a storage device. A bind mount, on the other hand, replicates an existing directory tree to another mount point. The directories and files obtained through the bind mount are identical to the original ones; any changes made from either the mount directory or the original directory are immediately reflected on the other side. In simple terms, any mount point, ordinary directory, or file can be mounted elsewhere. If unmounted maliciously, it can cause data inconsistency and service unavailability.

Risk Items¶

• Data inconsistency

• Service unavailability

Audit Method¶

• Verify whether the path is unmounted. The following command can be used to check:

mount

Remediation¶

• If the path is unmounted maliciously, carefully inspect the host environment to prevent service unavailability.

Impact¶

• None

Default Value¶

• None

References¶

• Hacker intrusion emergency investigation ideas && process (Unofficial)

• Record of a real mining intrusion investigation analysis (Unofficial)

CIS Controls¶

• None