Kernel module loaded or the module tree modified on Linux

Siemphony@siemphonylowT1547.006unverified

Covers both halves of AN1243 on the one log source they share: an auditd SYSCALL record whose `exe` is a module-management tool, and an auditd PATH record naming a kernel object file or anything inside the module tree. The path half is MITRE's `FilePathRegex` knob, populated here with the `/lib/modules/` substring — a substring rather than a prefix so that distributions which ship the tree at `/usr/lib/modules/` are included — plus the kernel object suffixes themselves, and those are listed as `.ko`, `.ko.xz`, `.ko.zst` and `.ko.gz` because most current distributions install modules compressed and a bare `.ko` endswith silently misses every one of them. The tool half needs the same care in the other direction: on Debian, Ubuntu, RHEL, Fedora and Arch, `insmod`, `rmmod`, `modprobe`, `depmod`, `lsmod` and `modinfo` are all symlinks to a single `kmod` binary, and auditd resolves `exe=` to the executable that was actually mapped, so a selector listing only `/insmod` and `/modprobe` is dead on a modern host. `/kmod` is therefore in the list, and the price of including it is that the read-only queries `lsmod` and `modinfo` match exactly as a load does. Four limits are worth stating before this is deployed. First, the loading paths that skip the tools entirely are missed: `systemd-modules-load` and `systemd-udevd` call `finit_module` directly at boot, and a rootkit dropper that calls `init_module` from its own compiled code execs nothing at all, so the SYSCALL leg never sees either. Second, the `.ko` selection is only as good as the audit configuration behind it — a PATH record is emitted for an audited syscall or a watched path, so a module staged in `/tmp` and loaded from there produces no PATH record unless `openat` is audited globally, which almost nobody does for cost reasons. Third, MITRE's `UserContext` knob cannot be applied inside this rule: auditd splits one event across records and `uid`/`auid` live only on the SYSCALL side, so the PATH selections have no user to filter on. Fourth, MITRE's `TimeWindow` knob is a change-window suppression, which lib/sigma has no way to express. The macOS arm AN1244 is not attempted — its sources are `macos:unifiedlog` and `macos:osquery`, neither of which has a standardised Sigma field vocabulary, so `kextload`, the `/Library/Extensions` write and the KextPolicy database change would all have to be written against invented field names; that is the same ground on which T1543.001 and T1546.014 declined their macOS legs. The osquery leg of AN1243 is unattempted for the same reason. Prerequisite: auditd ships with no rules loaded on any mainstream distribution, so this rule returns zero rows until both an execve rule such as `-a always,exit -F arch=b64 -S execve -k exec` and a watch such as `-w /lib/modules -p wa -k modules` are in place — and zero rows reads as quiet when it actually means blind. The watch permission also sets the noise floor: `wa` records writes and attribute changes only, whereas adding `r` makes every module the kernel loads on demand match as well. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0450, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* ((type="SYSCALL" AND (exe="*/insmod" OR exe="*/rmmod" OR exe="*/modprobe" OR exe="*/depmod" OR exe="*/kmod")) OR (type="PATH" AND (name="*.ko" OR name="*.ko.xz" OR name="*.ko.zst" OR name="*.ko.gz")) OR (type="PATH" AND name="*/lib/modules/*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(type) == "syscall" AND (TO_LOWER(exe) LIKE "*/insmod" OR TO_LOWER(exe) LIKE "*/rmmod" OR TO_LOWER(exe) LIKE "*/modprobe" OR TO_LOWER(exe) LIKE "*/depmod" OR TO_LOWER(exe) LIKE "*/kmod")) OR (TO_LOWER(type) == "path" AND (TO_LOWER(name) LIKE "*.ko" OR TO_LOWER(name) LIKE "*.ko.xz" OR TO_LOWER(name) LIKE "*.ko.zst" OR TO_LOWER(name) LIKE "*.ko.gz")) OR (TO_LOWER(type) == "path" AND TO_LOWER(name) LIKE "*/lib/modules/*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^SYSCALL$</field>    <field name="exe" type="pcre2">(?i)(/insmod$|/rmmod$|/modprobe$|/depmod$|/kmod$)</field>    <description>Kernel module loaded or the module tree modified on Linux (1/3)</description>    <mitre>      <id>T1547.006</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^PATH$</field>    <field name="name" type="pcre2">(?i)(\.ko$|\.ko\.xz$|\.ko\.zst$|\.ko\.gz$)</field>    <description>Kernel module loaded or the module tree modified on Linux (2/3)</description>    <mitre>      <id>T1547.006</id>    </mitre>  </rule>   <rule id="100002" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="type" type="pcre2">(?i)^PATH$</field>    <field name="name" type="pcre2">(?i)/lib/modules/</field>    <description>Kernel module loaded or the module tree modified on Linux (3/3)</description>    <mitre>      <id>T1547.006</id>    </mitre>  </rule></group>

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"linux","service":"auditd"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: auditd / linux
Level: low
Category: registry_persistence
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 443de8eb-79c3-4f99-8749-e1ef2c0e7f8b

ATT&CKT1547.006

T1547.006Kernel Modules and Extensions

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonregistry persistence

registry persistenceAI draft — unreviewed

01 · What this rule detects

AN1243 asks for kernel module load and unload activity via modprobe, insmod and rmmod, plus direct manipulation of /lib/modules. This rule covers both halves on the one log source they share. Read a hit precisely: it means something touched the module tooling or the module tree. It does not mean a module loaded, and the two are further apart than they look.

02 · Telemetry you need

product: linux / service: auditd, copied verbatim from AN1243. auditd ships with no rules loaded on any mainstream distribution, so this returns zero rows until both an execve rule (-a always,exit -F arch=b64 -S execve -k exec) and a watch (-w /lib/modules -p wa -k modules) are in place — and zero rows reads as quiet when it means blind. The watch permission sets the noise floor: wa records writes and attribute changes, while adding r makes every module the kernel loads on demand match too.
Three of four backends render; Sentinel refuses the rule outright, since lib/sigma models no Sentinel table for auditd. A Sentinel-only reader gets nothing here.

03 · How the logic works

condition: 1 of selection* across three blocks. selection_module_tools is type: SYSCALL ANDed with exe|endswith on /insmod, /rmmod, /modprobe, /depmod, /kmod. /kmod is the entry that carries the selection: on Debian, Ubuntu, RHEL, Fedora and Arch those applets are all symlinks to a single kmod binary, and auditd resolves exe= to the executable actually mapped, so a list without it is dead on a modern host. The price is that read-only lsmod and modinfo match byte-identically to insmod rootkit.ko. This arm is a filter for "something touched kmod". selection_module_object is type: PATH with name|endswith on .ko, .ko.xz, .ko.zst, .ko.gz — most distributions install modules compressed, and a bare .ko silently misses all of them. selection_module_tree is type: PATH with name|contains: '/lib/modules/'. That is MITRE's FilePathRegex knob, populated here with a substring rather than a prefix so distributions shipping the tree at /usr/lib/modules/ are included; the substring is the pipeline's choice, not MITRE's. Two MITRE knobs cannot be expressed. UserContext fails because auditd splits one event across records and uid/auid live only on SYSCALL, leaving the PATH selections with no user to filter on. TimeWindow is change-window suppression, which lib/sigma has no way to model. The gap worth naming: the record that witnesses a load directly — auditd's type=KERN_MODULE — is not in the rule. A rootkit dropper calling init_module from its own compiled code execs nothing and stages nothing under /lib/modules, so it passes clean. The malicious case falls in the gap.

04 · Common false positives

Enormously. One kernel upgrade unpacks several thousand .ko files into a new /lib/modules/<version> and runs depmod across the tree, matching both path selections thousands of times per host; DKMS repeats it after every kernel change. Inventory agents polling lsmod — osquery, Zabbix, EDR, CIS scripts — are indistinguishable from a load, and ordinary operation loads modules constantly: mounting a filesystem, attaching USB, starting a container. Hence level: low.

05 · Detection maturity

tier_1: , and it stays there until it has been run against real data. That exe= resolves to kmod is documented behaviour, not something this rule has observed.
tier_2: run read-only through one kernel upgrade cycle and count — a day tells you whether the path selections are usable at all.
tier_3: demote the tool arm to context and alert on a module loading from a path outside the module tree, which is the shape a dropper actually has.

Tuning & false positivesexperimental · 5 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add selection_kern_module: {type: 'KERN_MODULE'} to the 1-of group and
Suppress the read-only applets. SYSCALL also carries comm=, which holds the
Exclude package-manager activity or correlate against the package database

Declared by the author

Kernel package installation and upgrade. A single kernel update unpacks several thousand kernel object files into a new /lib/modules/<version> directory and then runs depmod across the whole tree, so one unattended-upgrade or dnf update run produces thousands of matches on both path selections on every host in the fleet. This is the loudest source here by an enormous margin and is the reason the level is low.
Inventory and monitoring agents polling loaded modules. Because lsmod and modinfo resolve to the same kmod binary as insmod and modprobe, osquery, Zabbix, Nagios, EDR sensors and CIS-benchmark scripts all match the tool selection on a schedule while doing nothing but reading.
DKMS rebuilds of out-of-tree drivers after every kernel change, which compile a kernel object, copy it into the module tree, and then call depmod and modprobe. Graphics drivers, hypervisor guest additions, ZFS and various VPN modules all behave this way on ordinary workstations and servers.
On-demand module loading during normal operation. Mounting a filesystem, bringing up a network interface, attaching a USB device, starting a container, or running an iptables or nftables command all cause the kernel to request a module and userspace to exec modprobe.
Administrative hardware troubleshooting, where an operator cycles a network, storage or audio driver with rmmod followed by modprobe, or loads a vendor diagnostic module by hand from a support bundle.

Noise check0 of 5 fired

Fires on none of the 5 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 5 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1547.006, evaluated against their — events.

Share this rule

/u/siemphony/443de8eb-79c3-4f99-8749-e1ef2c0e7f8b

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Kernel module loaded or the module tree modified on Linux

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Sentinel · KQL

Community

Verdicts from engineers who deployed it