LoFP / mknod is a linux system program. some normal use of this program, at varying levels of frequency, may originate from scripts, automation tools, and frameworks. usage by web servers is more likely to be suspicious.

Techniques

Sample rules

Mknod Process Activity

• source: elastic
• technicques:

Description

The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits. It is used to export a command shell when the traditional version of netcat is not available to the payload.

Detection logic

event.category:process and event.type:(start or process_started) and process.name:mknod