Elastic low deprecated eql

Deprecated - Creation of Kernel Module

Identifies activity related to loading kernel modules on Linux via creation of new ko files in the LKM directory.

View Source

Detection Logic

file where host.os.type == "linux" and event.type in ("change", "creation") and file.path : "/lib/modules/*" and
file.extension == "ko" and not process.name : (
  "dpkg", "systemd", "falcon-sensor*", "dnf", "yum", "rpm", "cp"
)

Field Validations

Loading…

Comments (0)

Loading comments...