IMPORTANT: No additional bug fixes or documentation updates will be released for this version.
Kernel Module Removaledit
Identifies attempts to remove a kernel module. Kernel modules are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system.
Rule type: query
Rule indices:
- auditbeat-*
Severity: high
Risk score: 73
Runs every: 5 minutes
Searches indices from: now-6m (Date Math format, see also Additional look-back time)
Maximum signals per execution: 100
References:
Tags:
- Elastic
- Linux
Version: 1
Added (Elastic Stack release): 7.8.0
Potential false positivesedit
There is usually no reason to remove modules, but some buggy modules require removal. These can be exempted by username. Note that some Linux distributions are not built to support the removal of modules at all.
Rule queryedit
event.action:executed and process.args:(rmmod and sudo or modprobe and
sudo and ("--remove" or "-r"))
Threat mappingedit
Framework: MITRE ATT&CKTM
-
Tactic:
- Name: Defense Evasion
- ID: TA0005
- Reference URL: https://attack.mitre.org/tactics/TA0005/
-
Technique:
- Name: Disabling Security Tools
- ID: T1089
- Reference URL: https://attack.mitre.org/techniques/T1089/
-
Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/tactics/TA0003/
-
Technique:
- Name: Kernel Modules and Extensions
- ID: T1215
- Reference URL: https://attack.mitre.org/techniques/T1215/