Anvilogic high experimental spl

Linux Kernel Module Commands [splunk-unix]

Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Atomics T1014 Test #1 Atomics T1014 Test #2 Atomics T1547.006 Test#1

View Source

Detection Logic

`get_endpoint_data` `get_endpoint_data_unix` (type=proctitle 
OR type=execve 
OR sourcetype=bash_history) 
AND ((TERM(insmod) 
OR TERM(rmmod) 
OR TERM(depmod)) 
OR TERM(modprobe) 
OR TERM(lsmod) 
OR TERM(modinfo) 
OR TERM(kmod))
| table _time, host, user, process, process_*
| bin span=1s
| stats values(*) as * by _time, host

Field Validations

Loading…

Comments (0)

Loading comments...