T1564.013 — Bind Mounts

Tactic: Stealth · Platforms: Linux

Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (1)

T1564.013 Hide Artifacts: Bind Mounts

title: "T1564.013 Hide Artifacts: Bind Mounts"
id: 6dacd908-82c8-4219-a40c-bf86d80e7046
description: 'Detection Strategy for Bind Mounts on Linux, now covering all documented mount-bind invocation styles (--bind, -B, and -o bind) instead of only the literal --bind flag. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: BindMountFlags, WatchedProcPaths, CorrelationWindow.'
references:
  - https://attack.mitre.org/techniques/T1564/013
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.stealth
  - attack.t1564.013

logsource:
  category: process_creation
  product: linux

detection:
  selection_bind_flag:
    type: EXECVE
    a0|endswith: '/mount'
    a1:
      - '--bind'
      - '-B'
  selection_o_bind:
    type: EXECVE
    a0|endswith: '/mount'
    a1: '-o'
    a2|contains: 'bind'
  condition: 1 of selection_*

falsepositives:
  - Bind mounts are widely used by container runtimes (Docker/Kubernetes) and chroot/build systems for legitimate purposes across all three invocation styles (--bind, -B, -o bind); scope to unexpected targets under /proc or /etc (tune WatchedProcPaths).

level: medium

Related sub-techniques

Explore