Loading of Kernel Module via Insmod

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

This rule detects the loading of kernel modules using the 'insmod' command. Loadable Kernel Modules (LKMs) are code segments that can be dynamically loaded into and unloaded from the kernel. Adversaries may leverage LKMs for establishing persistence, elevating privileges, or deploying kernel-mode rootkits, as they operate with the highest system privileges (Ring 0). The detection specifically looks for the execution of 'kmod' with the 'insmod' command.