LoFP / security tools and device drivers may run these programs in order to load legitimate kernel modules. use of these programs by ordinary users is uncommon.

Techniques

• T1547

Sample rules

Persistence via Kernel Module Modification

• source: elastic
• technicques:
  • T1547

Description

Identifies loadable kernel module errors, which are often indicative of potential persistence attempts.

Detection logic

event.category:process and event.type:(start or process_started) and process.name:(insmod or kmod or modprobe or rmod)