huntrule

Linux: Kernel Module Load via insmod (kmod)

Flags Linux auditd syscalls where insmod is executed via /usr/bin/kmod to load a kernel module.

FreeUnreviewedSigmahighv1
title: "Linux: Kernel Module Load via insmod (kmod)"
id: 8e134ca7-2a63-45f7-b8f2-bba8b123afde
status: test
description: This rule detects kernel module loading activity when the process name is insmod and the executable path is /usr/bin/kmod. Loading Loadable Kernel Modules can enable persistence or facilitate privilege escalation by introducing code into the running kernel. It relies on Linux auditd syscall telemetry that includes the executed command name and the binary path.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md
  - https://linux.die.net/man/8/insmod
  - https://man7.org/linux/man-pages/man8/kmod.8.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_load_module_insmod.yml
author: Pawel Mazur, Huntrule Team
date: 2021-11-02
modified: 2022-12-25
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.006
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    comm: insmod
    exe: /usr/bin/kmod
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 106d7cbd-80ff-4985-b682-a7043e5acb72
    type: derived

What it detects

This rule detects kernel module loading activity when the process name is insmod and the executable path is /usr/bin/kmod. Loading Loadable Kernel Modules can enable persistence or facilitate privilege escalation by introducing code into the running kernel. It relies on Linux auditd syscall telemetry that includes the executed command name and the binary path.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.