linux_auditd_kernel_module_using_rmmod_utility.yml

name: Linux Auditd Kernel Module Using Rmmod Utility
id: 31810b7a-0abe-42be-a210-0dec8106afee
version: 6
date: '2025-05-02'
author: Teoderick Contreras, Splunk
status: production
type: TTP
description: The following analytic detects suspicious use of the `rmmod` utility
  for kernel module removal, which may indicate an attacker attempt to unload critical
  or security-related kernel modules. The `rmmod` command is used to remove modules
  from the Linux kernel, and unauthorized use can be a tactic to disable security
  features, conceal malicious activities, or disrupt system operations. By monitoring
  for unusual or unauthorized `rmmod` activity, this analytic helps identify potential
  tampering with kernel modules, enabling security teams to take proactive measures
  to protect system integrity and security.
data_source:
- Linux Auditd Syscall
search: '`linux_auditd` type=SYSCALL comm=rmmod
  | rename host as dest 
  | stats count min(_time) as firstTime max(_time) as lastTime 
  by comm exe  syscall uid ppid pid success dest 
  | `security_content_ctime(firstTime)` 
  | `security_content_ctime(lastTime)`
  | `linux_auditd_kernel_module_using_rmmod_utility_filter`'
how_to_implement: To implement this detection, the process begins by ingesting auditd
  data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
  executions and process details on Unix/Linux systems. These logs should be ingested
  and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
  which is essential for correctly parsing and categorizing the data. The next step
  involves normalizing the field names  to match the field names set by the Splunk
  Common Information Model (CIM) to ensure consistency across different data sources
  and enhance the efficiency of data modeling. This approach enables effective monitoring
  and detection of linux endpoints where auditd is deployed
known_false_positives: Administrator or network operator can use this application
  for automation purposes. Please update the filter macros to remove false positives.
references:
- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html
drilldown_searches:
- name: View the detection results for - "$dest$"
  search: '%original_detection_search% | search  dest = "$dest$"'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
- name: View risk events for the last 7 days for - "$dest$"
  search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$")
    starthoursago=168  | stats count min(_time) as firstTime max(_time) as lastTime
    values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
    as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
    as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`'
  earliest_offset: $info_min_time$
  latest_offset: $info_max_time$
rba:
  message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to remove a
    Linux kernel module using the rmmod utility.
  risk_objects:
  - field: dest
    type: system
    score: 72
  threat_objects: []
tags:
  analytic_story:
  - Linux Living Off The Land
  - Linux Privilege Escalation
  - Linux Persistence Techniques
  - Compromised Linux Host
  asset_type: Endpoint
  mitre_attack_id:
  - T1547.006
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: 
      https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_rmmod_new/linux_auditd_new_rmmod.log
    source: auditd
    sourcetype: auditd