0010-kernel-modules-add - Kernel Module Added¶
Rule ID¶
- 0010-kernel-modules-add
Category¶
- system
Level¶
- warn
Compatible Versions¶
- Linux
Description¶
- Monitor for kernel modules being added on the host.
Scan Frequency¶
- 1 */5 * * *
Rationale¶
- The kernel consists of a series of programs, including interrupt service routines that handle interrupts, a scheduler that manages multiple processes to share processor time, memory management that handles address spaces, networking, and inter-process communication system services. The kernel is responsible for managing the hardware devices of the system. Adding kernel modules can cause instability and security risks in system services, increasing the possibility of malicious code injection.
Risk Items¶
- Hacker Infiltration
- Data Leakage
- Network Security
- Cryptomining Risk
- Botnet Risk
Audit Method¶
- Verify whether kernel modules have been added on the host. You can run the following command to check:
Remediation¶
- If kernel modules have been added on the host, you can run the following commands to view and remove the module:
Please carefully examine the host environment to check if it has been compromised, and change the host user password.
Impact¶
- None
Default Value¶
- None
References¶
- Hacker Intrusion Emergency Response Ideas && Process (Unofficial)
- Record of a Real Cryptomining Intrusion Investigation and Analysis (Unofficial)
CIS Controls¶
- None