Linux: Kernel Module Loading via insmod (kmod)

Flags Linux auditd syscalls where insmod is executed via /usr/bin/kmod to load a kernel module.

FreeReviewedSigma · High · v3
Product
linux
Service
auditd
Author
Pawel Mazur (SigmaHQ), DRL 1.1
Published
2021-11-02
Updated
2026-07-31

ATT&CK techniques

Persistence → Priv Esc
  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Defense Evasion

  6. Cred Access

  7. Discovery

  8. Lateral Movement

  9. Collection

  10. C2

  11. Exfiltration

  12. Impact

What it detects

This rule identifies execution of the insmod command by matching process execution context where comm is insmod and the executable path is /usr/bin/kmod. Loading kernel modules can be used by attackers to extend kernel functionality for persistence or privilege escalation. It relies on Linux auditd telemetry that records command and executable path for the initiating process.

Related detections6 linkedT1547.006 — drag to rearrange
Suspicious Kernel Extension Load on macOS (via process_creation)
Malicious Houken sysinitd Rootkit Kernel Module Load via insmod (via process_creation)
Suspicious Kernel Module Load via insmod on Linux (via process_creation)
Malicious Kernel Module Loaded From a User-Writable Path on Linux (via process_creation)
Malicious VoidLink Kernel Module Load via Insmod (via process_creation)
Linux: Detect modprobe-based authencesn crypto module auto-load via kmod
Linux: Kernel Module Loading via insmod (kmod)
Pivot detection · T1547.006 · 6 related

Changelog

v3
  1. v3
    Candidate ingested via manual entry.2026-07-31
  2. v2
    Candidate ingested via manual entry.2026-07-31
  3. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.