LoFP / security tools and device drivers may run these programs in order to enumerate kernel modules. use of these programs by ordinary users is uncommon. these can be exempted by process name or username.

Techniques

• T1082

Sample rules

Enumeration of Kernel Modules

• source: elastic
• technicques:
  • T1082

Description

Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module.

Detection logic

event.category:process and host.os.type:linux and event.type:start and event.action:(exec or exec_event) and (
 (process.name:(lsmod or modinfo)) or 
 (process.name:kmod and process.args:list) or 
 (process.name:depmod and process.args:(--all or -a))
) and not process.parent.name:(mkinitramfs or cryptroot or framebuffer or dracut or jem or thin-provisioning-tools
or readykernel or lvm2 or vz-start or iscsi or mdadm or ovalprobes or bcache or plymouth or dkms or overlayroot or 
weak-modules or zfs)

Enumeration of Kernel Modules via Proc

• source: elastic
• technicques:
  • T1082

Description

Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. This identifies attempts to enumerate information about a kernel module using the /proc/modules filesystem. This filesystem is used by utilities such as lsmod and kmod to list the available kernel modules.

Detection logic

host.os.type:linux and event.category:file and event.action:"opened-file" and file.path:"/proc/modules" and
not process.name:(grep or python* or chef-client)