Loadable Kernel Module Load via Forked Memory File Descriptor

[rule]
description = """
This rule detects when a process creates a memory file descriptor using the memfd_create syscall followed by loading a
loadable kernel module (LKM) via a fork. This activity indicates an active attempt to load a kernel module and should be
considered highly abnormal or suspicious. This activity can occur when the modprobe userland utility is invoked, or when
the underlying init_module/finit_module syscalls are used, to load a kernel module via a command and control channel.
"""
id = "76fac24d-7736-4aed-bcd0-feed2286385d"
license = "Elastic License v2"
name = "Loadable Kernel Module Load via Forked Memory File Descriptor"
os_list = ["linux"]
version = "1.0.3"

query = '''
sequence with maxspan=5s
  [process where event.action == "memfd_create" and
  not (
    (
      process.executable == "/opt/eset/efs/sbin/startd" and
      process.command_line == "/opt/eset/efs/sbin/startd" and
      process.parent.executable == "/usr/lib/systemd/systemd"
    ) or
    (
      process.executable == "/usr/lib/systemd/systemd" and
      process.command_line == "/sbin/init" and
      process.Ext.memfd.name == "memfd:system-environment-generators" and
      process.parent.executable == "/usr/bin/runc"
    ) or
    (
      process.executable like "/usr/libexec/platform-python3*" and
      process.parent.executable == "/usr/lib/systemd/systemd" and
      process.Ext.memfd.name == "memfd:libffi"
    ) or
    (process.parent.executable like "/snap/lxd/*/sbin/lxd" and process.command_line == "/sbin/modprobe -b zfs")
  )] by process.entity_id
  [process where event.action == "load_module"] by process.parent.entity_id
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1014"
name = "Rootkit"
reference = "https://attack.mitre.org/techniques/T1014/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.009"
name = "Proc Memory"
reference = "https://attack.mitre.org/techniques/T1055/009/"


[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "9.1.4"