Loading of Kernel Module via Insmod

Title: Loading of Kernel Module via Insmod
Status: test
Description:Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md
  -https://linux.die.net/man/8/insmod
  -https://man7.org/linux/man-pages/man8/kmod.8.html
Author: Pawel Mazur
Date: 2021-11-02
modified:2022-12-25
Tags:

• -'attack.persistence'
• -'attack.privilege-escalation'
• -'attack.t1547.006'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'SYSCALL'
    comm: 'insmod'
    exe: '/usr/bin/kmod'
  condition:selection
Falsepositives:
  -Unknown
Level: high