Create files below dev

rule: Create files below dev
desc: 'Detect the creation of files under /dev except for authorized device management
  programs. This can reveal rootkits hiding files in /dev. Additionally, consider
  the "Execution from /dev/shm" rule. The upstream rule already covers some tuning
  scenarios that you can further expand upon.

  '
condition: '(evt.type = creat or (evt.type in (open,openat,openat2))) and evt.arg.flags
  contains O_CREAT and fd.directory = /dev and not proc.name in (dev_creation_binaries)
  and not fd.name in (allowed_dev_files) and not fd.name startswith /dev/tty and not
  user_known_create_files_below_dev_activities

  '
output: File created below /dev by untrusted program | file=%fd.name evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
priority: ERROR
tags:
- maturity_incubating
- host
- filesystem
- mitre_persistence
- T1543