kqlElastic-2.0from elastic/detection-rules
Tainted Kernel Module Load
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/linux/persistence_tainted_kernel_module_load.toml
host.os.type:linux and data_stream.dataset:"system.syslog" and process.name:kernel and
message:"module verification failed: signature and/or required key missing - tainting kernel"