Identifier / Programs / Linux and Unix

mount

Get access to an entire filesystem in one directory. tldr-pages

GTFOBins privilege-escalation 1 Sigma rule name it 1 ATT&CK technique 1 documented command

How mount is abused

documented by GTFOBins

privilege-escalation

-o

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for mount.

1 documented command

from GTFOBins, each read by the identifier

privilege-escalation with sudo

This overrides mount itself with a shell (or any other executable).

mount -o bind /bin/sh /bin/mount
mount

Identify

The command the identifier reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for mount. The identifier reads the line that runs mount.

What detects it

Sigma process creation rules

mediumMount Execution With Hidepid ParameterJoseliyo Sanchez, @Joseliyo_Jstnk

T1564Hide Artifacts

Everyday use

from tldr-pages, CC BY 4.0

Show all mounted filesystems

mountIdentify

Mount a device to a directory

mount path/to/device_file path/to/target_directoryIdentify

Create a specific directory if it does not exist and mount a device to it

mount --mkdir path/to/device_file path/to/target_directoryIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

7 in toybox

Show every option of mount

-aMount all entries in /etc/fstab (with -t, only entries of that TYPE)

-OOnly mount -a entries that have this option

-fFake it (don't actually mount)

-rRead only (same as -o ro)

-wRead/write (default, same as -o rw)

-t TYPESpecify filesystem type

-vVerbose