Sunturai
Back to results
InformationalSplunk security contentTeoderick Contreras +1

Linux Auditd Install Kernel Module Using Modprobe Utility

The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is…

Description

The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.

Detection logic

Detection requirements

Platform
LinuxmacOS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
linux_auditd_syscall

Known benign triggers

  • Administrator or network operator can execute this command. Please update the filter macros to remove false positives.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice