attack.t1547.006

Loading of Kernel Module via Insmod

Aug 12, 2024 · attack.persistence attack.privilege-escalation attack.t1547.006 ·

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

Non-depmod Process Modifying modules.dep

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·

Share on:

Detects unusual process modifying the modules.dep file. The modules.dep and modules.dep.bin files should only be modified by the depmod utility. Part of the RedCanary 2024 Threat Detection Report.

Shells Modifying Files in Known Linux Kernel Modules Directories

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·

Share on:

Detects configuration files being written to specific directories that are searched when looking for loadable Linux Kernel Modules (LKM). Part of the RedCanary 2024 Threat Detection Report.

Systemd Loading a Linux Kernel Module Using insmod

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·

Share on:

Detects the systemd process running commands that would load a Linux Kernel Modules. Part of the RedCanary 2024 Threat Detection Report.

Systemd Loading a Linux Kernel Module Using modprobe

Mar 26, 2024 · attack.persistence attack.privilege_escalation attack.t1547 attack.t1547.006 ·

Share on:

Detects the systemd process loading a Linux Kernel Modules using modprobe. Part of the RedCanary 2024 Threat Detection Report.