IMPORTANT: No additional bug fixes or documentation updates will be released for this version.
Kernel Module Removal
editKernel Module Removal
editIdentifies attempts to remove a kernel module. Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system.
Rule type: query
Rule indices:
- auditbeat-*
Severity: high
Risk score: 73
Runs every: 5 minutes
Searches indices from: now-6m (Date Math format, see also Additional look-back time)
Maximum signals per execution: 100
References:
Tags:
- Elastic
- Linux
Version: 1
Added (Elastic Stack release): 7.8.0
Potential false positives
editThere is usually no reason to remove modules, but some buggy modules require removal. These can be exempted by username. Note that some Linux distributions are not built to support the removal of modules at all.
Rule query
editevent.action:executed and process.args:(rmmod and sudo or modprobe and
sudo and ("--remove" or "-r"))
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: Disabling Security Tools
- ID: T1089
- Reference URL: https://attack.mitre.org/techniques/T1089/
-
Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
-
Technique:
- Name: Kernel Modules and Extensions
- ID: T1215
- Reference URL: https://attack.mitre.org/techniques/T1215/