| splunk |
Linux Kernel Module Enumeration |
production |
2026-10-09 |
| elastic |
Kernel Object File Creation |
production |
2026-10-05 |
| elastic |
BPF Program or Map Load via bpftool |
production |
2026-09-18 |
| elastic |
Kernel Module Loaded with Tainting Flags |
production |
2026-09-18 |
| elastic |
Tainted Out-Of-Tree Kernel Module Load |
production |
2026-09-18 |
| elastic |
Suspicious Kworker UID Elevation |
production |
2026-09-18 |
| elastic |
Kernel Load or Unload via Kexec Detected |
production |
2026-09-18 |
| elastic |
UID Elevation from Previously Unknown Executable |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Network Activity Detected via Kworker |
production |
2026-09-18 |
| elastic |
BPF Program Tampering via bpftool |
production |
2026-09-18 |
| elastic |
Unusual Kill Signal |
production |
2026-09-18 |
| elastic |
Kernel Instrumentation Discovery via kprobes and tracefs |
production |
2026-09-18 |
| elastic |
Kernel Seeking Activity |
production |
2026-09-18 |
| elastic |
Kernel Unpacking Activity |
production |
2026-09-18 |
| elastic |
Unusual Execution from Kernel Thread (kthreadd) Parent |
production |
2026-09-18 |
| elastic |
Suspicious Usage of bpf_probe_write_user Helper |
production |
2026-09-18 |
| elastic |
Kernel Module Load via Built-in Utility |
production |
2026-09-18 |
| elastic |
Kernel Driver Load |
production |
2026-09-18 |
| elastic |
Kernel Driver Load by non-root User |
production |
2026-09-18 |
| elastic |
Kernel Module Load from Unusual Location |
production |
2026-09-18 |
| elastic |
Suspicious File Creation via Kworker |
production |
2026-09-18 |
| elastic |
Loadable Kernel Module Configuration File Creation |
production |
2026-09-18 |
| elastic |
Tainted Kernel Module Load |
production |
2026-09-18 |
| splunk |
Windows Driver Load Non-Standard Path |
production |
2026-05-13 |
| splunk |
Windows Drivers Loaded by Signature |
production |
2026-05-13 |
| splunk |
Linux Medusa Rootkit |
production |
2026-05-13 |
| splunk |
Linux Auditd Kernel Module Enumeration |
production |
2026-05-13 |
| sigma |
Triple Cross eBPF Rootkit Install Commands |
test |
2022-07-05 |