| elastic |
Kernel Module Removal |
production |
2026-10-09 |
| elastic |
Kernel Object File Creation |
production |
2026-10-05 |
| splunk |
Windows Snake Malware Service Create |
production |
2026-10-02 |
| splunk |
Windows Snake Malware Kernel Driver Comadmin |
production |
2026-10-02 |
| splunk |
Linux Insert Kernel Module Using Insmod Utility |
production |
2026-10-02 |
| splunk |
Linux Auditd Insert Kernel Module Using Insmod Utility |
production |
2026-10-02 |
| elastic |
Kernel Driver Load by non-root User |
production |
2026-09-18 |
| elastic |
Kernel Driver Load |
production |
2026-09-18 |
| elastic |
Kernel Module Load from Unusual Location |
production |
2026-09-18 |
| elastic |
Loadable Kernel Module Configuration File Creation |
production |
2026-09-18 |
| elastic |
Tainted Kernel Module Load |
production |
2026-09-18 |
| elastic |
Kernel Module Loaded with Tainting Flags |
production |
2026-09-18 |
| elastic |
Tainted Out-Of-Tree Kernel Module Load |
production |
2026-09-18 |
| elastic |
Kernel Load or Unload via Kexec Detected |
production |
2026-09-18 |
| elastic |
Attempt to Unload Elastic Endpoint Security Kernel Extension |
production |
2026-09-18 |
| elastic |
First Time Seen Driver Loaded |
production |
2026-09-18 |
| elastic |
Potential Persistence via File Modification |
production |
2026-09-18 |
| elastic |
Suspicious Usage of bpf_probe_write_user Helper |
production |
2026-09-18 |
| elastic |
BPF Program or Map Load via bpftool |
production |
2026-09-18 |
| elastic |
Kernel Module Load via Built-in Utility |
production |
2026-09-18 |
| splunk |
Linux File Created In Kernel Driver Directory |
production |
2026-05-13 |
| splunk |
Linux Install Kernel Module Using Modprobe Utility |
production |
2026-05-13 |
| splunk |
Linux Auditd Unload Module Via Modprobe |
production |
2026-05-13 |
| splunk |
Linux Auditd Kernel Module Using Rmmod Utility |
production |
2026-05-13 |
| splunk |
Linux Auditd Install Kernel Module Using Modprobe Utility |
production |
2026-05-13 |
| sigma |
Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator |
experimental |
2026-05-09 |
| elastic |
Deprecated - Creation of Kernel Module |
deprecated |
2026-02-04 |
| sigma |
Loading of Kernel Module via Insmod |
test |
2022-12-25 |
| elastic |
Persistence via Kernel Module Modification |
deprecated |
2021-04-15 |