Kernel Modules and Extensions

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("insmod", "modprobe", "kextload", "kextutil")
   or (FileName =~ "modinfo" and ProcessCommandLine has_any (".ko", "rootkit", "diamorphine", "reptile"))
| extend ModulePath = extract(@"([\w/\-\.]+\.ko)", 1, ProcessCommandLine)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, ModulePath,
         InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc

(index=linux sourcetype=syslog ("insmod" OR "modprobe" OR "init_module" OR "finit_module"))
  OR (index=linux sourcetype="linux:audit" (type="SYSCALL" (syscall="init_module" OR syscall="finit_module")))
| eval KernelModule=if(match(_raw, "([\w/\-]+\.ko)"), replace(_raw, ".*(([\w/\-]+\.ko)).*", "\1"), "unknown")
| eval SuspiciousName=if(match(_raw, "(?i)(rootkit|diamorphine|reptile|phalanx|drovorub|hidden|stealth|backdoor)"), 1, 0)
| table _time, host, KernelModule, SuspiciousName, _raw
| sort - _time

process where event.type == "start" and (
  process.name in ("insmod", "modprobe", "kextload", "kextutil") or
  (process.name == "modinfo" and process.args : ("*.ko", "*rootkit*", "*diamorphine*", "*reptile*")) or
  (process.name in ("insmod", "modprobe") and process.args : ("*diamorphine*", "*reptile*", "*phalanx*", "*drovorub*", "*hidden*", "*stealth*", "*backdoor*", "*rootkit*"))
)

SELECT DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       sourceip,
       username,
       "hostname",
       QIDNAME(qid) AS event_name,
       UTF8(payload) AS raw_payload
FROM events
WHERE LOGSOURCETYPEID IN (11, 13, 105)
  AND devicetime > DATEADD('hour', -24, NOW())
  AND (
    UTF8(payload) ILIKE '%insmod%'
    OR UTF8(payload) ILIKE '%modprobe%'
    OR UTF8(payload) ILIKE '%init_module%'
    OR UTF8(payload) ILIKE '%finit_module%'
    OR UTF8(payload) ILIKE '%kextload%'
    OR UTF8(payload) ILIKE '%kextutil%'
    OR UTF8(payload) ILIKE '%diamorphine%'
    OR UTF8(payload) ILIKE '%reptile%'
    OR UTF8(payload) ILIKE '%phalanx%'
    OR UTF8(payload) ILIKE '%drovorub%'
    OR UTF8(payload) ILIKE '%rootkit%'
    OR (UTF8(payload) ILIKE '%.ko%' AND (UTF8(payload) ILIKE '%insmod%' OR UTF8(payload) ILIKE '%modprobe%'))
  )
ORDER BY devicetime DESC

_sourceCategory=linux* OR _sourceCategory=syslog* OR _sourceCategory=auditd*
| where _raw matches /insmod|modprobe|init_module|finit_module|kextload|kextutil/
| parse regex field=_raw "(?<kernel_module>[\w/\-]+\.ko)" nodrop
| parse regex field=_raw "(?i)(?<suspicious_name>diamorphine|reptile|phalanx|drovorub|skidmap|hidden|stealth|backdoor|rootkit)" nodrop
| eval is_suspicious = if (!isNull(suspicious_name) OR !isNull(kernel_module) AND suspicious_name != "", 1, 0)
| parse regex field=_raw "(?:exe|comm)=\"?(?<process_name>[\w\-\.]+)\"?" nodrop
| parse regex field=_raw "(?:uid=|auid=)(?<uid>\d+)" nodrop
| fields _messageTime, _sourceHost, process_name, kernel_module, suspicious_name, is_suspicious, uid, _raw
| sort by _messageTime desc

rule lkm_rootkit_kernel_module_loading {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects suspicious kernel module loading via insmod, modprobe, kextload, or kextutil. Covers known LKM rootkits including Diamorphine, REPTILE, Phalanx, and Drovorub (T1547.006)."
    severity = "HIGH"
    priority = "HIGH"
    mitre_attack_tactic = "Persistence"
    mitre_attack_technique = "T1547.006"
    reference = "https://attack.mitre.org/techniques/T1547/006/"
    created = "2026-04-20"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    (
      $e.principal.process.file.full_path = /\/insmod$/ or
      $e.principal.process.file.full_path = /\/modprobe$/ or
      $e.principal.process.file.full_path = /\/kextload$/ or
      $e.principal.process.file.full_path = /\/kextutil$/ or
      (
        $e.principal.process.file.full_path = /\/modinfo$/ and
        (
          $e.target.process.command_line = /\.ko/ or
          $e.target.process.command_line = /rootkit/ or
          $e.target.process.command_line = /diamorphine/ or
          $e.target.process.command_line = /reptile/
        )
      ) or
      $e.target.process.command_line = /(?i)(diamorphine|reptile|phalanx|drovorub|skidmap|hidden|stealth|backdoor)/
    )

  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ImageFileName = /(?i)(insmod|modprobe|kextload|kextutil)$/
  OR (ImageFileName = /(?i)modinfo$/ AND CommandLine = /\.ko|rootkit|diamorphine|reptile/i)
  OR CommandLine = /(?i)(diamorphine|reptile|phalanx|drovorub|skidmap|hidden\.ko|stealth\.ko|backdoor\.ko)/
| regex(field=CommandLine, regex="(?P<kernel_module>[\w/\-]+\.ko)", flags="i")
| eval SuspiciousRootkit = if(CommandLine matches "(?i)(diamorphine|reptile|phalanx|drovorub|skidmap)", "true", "false")
| groupBy([ComputerName, UserName, ImageFileName, CommandLine, kernel_module, SuspiciousRootkit], function=count(aid, as=event_count))
| sort(event_count, order=desc)