splApache-2.0from splunk/security_content

Linux Auditd Install Kernel Module Using Modprobe Utility

The following analytic detects the installation of a Linux kernel module using the modprobe utility. It leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant because installing a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level code, potentially leading to elevated privileges and bypassing security detections. If confirmed malicious, this could allow an attacker to gain persistent, high-level access to the system, compromising its integrity and security.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml

`linux_auditd` type=SYSCALL comm=modprobe
  | rename host as dest
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY comm exe syscall
       uid ppid pid
       success dest
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `linux_auditd_install_kernel_module_using_modprobe_utility_filter`