Skip to content

Hide Navigation Hide TOC

Loading of Kernel Module via Insmod (106d7cbd-80ff-4985-b682-a7043e5acb72)

Detects loading of kernel modules with insmod command. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. Adversaries may use LKMs to obtain persistence within the system or elevate the privileges.

Cluster A Galaxy A Cluster B Galaxy B Level
Loading of Kernel Module via Insmod (106d7cbd-80ff-4985-b682-a7043e5acb72) Sigma-Rules Kernel Modules and Extensions - T1547.006 (a1b52199-c8c5-438a-9ded-656f1d0888c6) Attack Pattern 1
Boot or Logon Autostart Execution - T1547 (1ecb2399-e8ba-4f6b-8ba7-5c27d49405cf) Attack Pattern Kernel Modules and Extensions - T1547.006 (a1b52199-c8c5-438a-9ded-656f1d0888c6) Attack Pattern 2