BIOC
Informational
✕
Kernel modules loaded via command-line tool
The insmod/depmod command loads a kernel module; attackers may use kernel modules as rootkits.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Persistence
- Status:
- Enabled
ATT&CK tactics: Persistence (TA0003)
ATT&CK techniques: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
Indicator:
Process action type = execution AND target process cmd != *ksplice* AND target process name = insmod Process initiated by != ds_am AND ds_agent AND ds_agent.init AND initiated by != savd* AND gpfsrunlevel AND runmmfs AND cgo name != ds_am AND ds_agent AND ds_agent.init AND cgo name != savd* AND gpfsrunlevel AND runmmfs AND initiator cmd != *sophos-av* AND *McAfee* AND *cisco* AND cgo cmd != *sophos-av* AND *McAfee* AND *cisco*
Preventable: yes