name: Linux Kernel Module Enumeration
id: 6df99886-0e04-4c11-8b88-325747419278
version: 1
date: '2022-07-27'
author: Michael Haag, Splunk
status: production
type: Anomaly
description: The following analytic identifies the process kmod being utilized to
  list kernel modules in use. Typically, this is not seen as malicious, however it
  may be a precurser to the use of insmod to install a module.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    CommandLine:
    - '*lsmod*'
    - '*list*'
    Image|endswith: kmod
  condition: selection1
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
  endpoint product.
known_false_positives: False positives are present based on automated tooling or system
  administrative usage. Filter as needed.
references:
- https://man7.org/linux/man-pages/man8/kmod.8.html
tags:
  analytic_story:
  - Linux Rootkit
  asset_type: Endpoint
  confidence: 50
  impact: 30
  message: An instance of $parent_process_name$ spawning $process_name$ was identified
    on endpoint $dest$ by user $user$ enumeration kernel modules.
  mitre_attack_id:
  - T1082
  - T1014
  observable:
  - name: user
    type: User
    role:
    - Victim
  - name: dest
    type: Hostname
    role:
    - Victim
  - name: parent_process_name
    type: Process
    role:
    - Parent Process
  - name: process_name
    type: Process
    role:
    - Child Process
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 15
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/linux-sysmon.log
    source: Syslog:Linux-Sysmon/Operational
    sourcetype: sysmon_linux
    update_timestamp: true