Elastic low deprecated kql

Persistence via Kernel Module Modification

Identifies loadable kernel module errors, which are often indicative of potential persistence attempts.

View Source

Detection Logic

event.category:process and event.type:(start or process_started) and process.name:(insmod or kmod or modprobe or rmod)

False Positives

  • ⚠ Security tools and device drivers may run these programs in order to load legitimate kernel modules. Use of these programs by ordinary users is uncommon.

Field Validations

Loading…

Comments (0)

Loading comments...