Linux: Kernel Module Loading via insmod (kmod)
Flags Linux auditd syscalls where insmod is executed via /usr/bin/kmod to load a kernel module.
- Product
- linux
- Service
- auditd
- Author
- Pawel Mazur (SigmaHQ), DRL 1.1
- Published
- 2021-11-02
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of the insmod command by matching process execution context where comm is insmod and the executable path is /usr/bin/kmod. Loading kernel modules can be used by attackers to extend kernel functionality for persistence or privilege escalation. It relies on Linux auditd telemetry that records command and executable path for the initiating process.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md
- linux.die.nethttps://linux.die.net/man/8/insmod
- man7.orghttps://man7.org/linux/man-pages/man8/kmod.8.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_load_module_insmod.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: Kernel Module Loading via insmod (kmod)"
id: 8e134ca7-2a63-45f7-b8f2-bba8b123afde
status: test
description: This rule identifies execution of the insmod command by matching process execution context where comm is insmod and the executable path is /usr/bin/kmod. Loading kernel modules can be used by attackers to extend kernel functionality for persistence or privilege escalation. It relies on Linux auditd telemetry that records command and executable path for the initiating process.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md
- https://linux.die.net/man/8/insmod
- https://man7.org/linux/man-pages/man8/kmod.8.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_load_module_insmod.yml
author: Pawel Mazur, Huntrule Team
date: 2021-11-02
modified: 2022-12-25
tags:
- attack.persistence
- attack.privilege-escalation
- attack.t1547.006
logsource:
product: linux
service: auditd
detection:
selection:
type: SYSCALL
comm: insmod
exe: /usr/bin/kmod
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 106d7cbd-80ff-4985-b682-a7043e5acb72
type: derived