The SIEM app is now a part of the Elastic Security solution.
Click
here to view the current documentation.
IMPORTANT: No additional bug fixes or documentation updates will be released for this version.
IMPORTANT: No additional bug fixes or documentation updates will be released for this version.
Persistence via Kernel Module Modification
editPersistence via Kernel Module Modification
editIdentifies loadable kernel module errors, which are often indicative of potential persistence attempts.
Rule type: query
Rule indices:
- auditbeat-*
Severity: low
Risk score: 21
Runs every: 5 minutes
Searches indices from: now-6m (Date Math format, see also Additional look-back time)
Maximum signals per execution: 100
References:
Tags:
- Elastic
- Linux
Version: 2 (version history)
Added (Elastic Stack release): 7.6.0
Last modified (Elastic Stack release): 7.7.0
Potential false positives
editSecurity tools and device drivers may run these programs in order to load legitimate kernel modules. Use of these programs by ordinary users is uncommon.
Rule query
editprocess.name:(insmod or kmod or modprobe or rmod) and event.action:executed
Threat mapping
editFramework: MITRE ATT&CKTM
-
Tactic:
- Name: Persistence
- ID: TA0003
- Reference URL: https://attack.mitre.org/techniques/TA0003/
-
Technique:
- Name: Kernel Modules and Extensions
- ID: T1215
- Reference URL: https://attack.mitre.org/techniques/T1215/
Rule version history
edit- Version 2 (7.7.0 release)
-
Updated query, changed from:
process.name: (insmod or kmod or modprobe or rmod) and event.action:executed