CmdID / Programs / Linux and Unix

mount

Get access to an entire filesystem in one directory. tldr-pages

GTFOBins privilege-escalation 1 Sigma rule name it 1 ATT&CK technique 1 documented command

How mount is abused

documented by GTFOBins

privilege-escalation

-o

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for mount.

1 documented command

from GTFOBins, each read by CmdID

privilege-escalation with sudo

This overrides mount itself with a shell (or any other executable).

mount -o bind /bin/sh /bin/mount
mount

Identify

The command CmdID reads trips no Sigma process-creation rule. This command is, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for mount. CmdID reads the line that runs mount.

What detects it

Sigma process creation rules

mediumMount Execution With Hidepid ParameterJoseliyo Sanchez, @Joseliyo_Jstnk

T1564Hide Artifacts

Everyday use

from tldr-pages, CC BY 4.0

Show all mounted filesystems

mountIdentify

Mount a device to a directory

mount path/to/device_file path/to/target_directoryIdentify

Create a specific directory if it does not exist and mount a device to it

mount --mkdir path/to/device_file path/to/target_directoryIdentify

None of the 3 examples CmdID reads matches GTFOBins abuse or trips a Sigma process-creation rule.

Options

7 in toybox

Show every option of mount

-aMount all entries in /etc/fstab (with -t, only entries of that TYPE)

-OOnly mount -a entries that have this option

-fFake it (don't actually mount)

-rRead only (same as -o ro)

-wRead/write (default, same as -o rw)

-t TYPESpecify filesystem type

-vVerbose