Potential Loadable Kernel Module Load via Memory File Descriptor

[rule]
description = """
This rule detects when a process creates a memory file descriptor using the memfd_create syscall followed by loading a
loadable kernel module (LKM). This activity is often associated with advanced threat actors attempting to evade
detection by avoiding writing files to disk. Such techniques are commonly used in fileless malware attacks and can
indicate a potential compromise or malicious activity. Memory file descriptors are a powerful tool for attackers to
execute code in memory and can be used to bypass traditional detection mechanisms.
"""
id = "9e39e74f-2c65-41e9-9b80-8ca874b3d4d1"
license = "Elastic License v2"
name = "Potential Loadable Kernel Module Load via Memory File Descriptor"
os_list = ["linux"]
version = "1.0.3"

query = '''
sequence by process.entity_id with maxspan=5s
  [process where event.type == "start" and event.action == "memfd_create" and
  not (
    process.executable == "/opt/eset/efs/lib/oaeventd" and
    process.command_line == "/opt/eset/efs/lib/oaeventd" and
    process.parent.executable == "/opt/eset/efs/sbin/startd"
  )]
  [process where event.type == "start" and event.action == "load_module"]
'''

min_endpoint_version = "9.1.4"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 1

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 1

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1106"
name = "Native API"
reference = "https://attack.mitre.org/techniques/T1106/"


[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1547"
name = "Boot or Logon Autostart Execution"
reference = "https://attack.mitre.org/techniques/T1547/"
[[threat.technique.subtechnique]]
id = "T1547.006"
name = "Kernel Modules and Extensions"
reference = "https://attack.mitre.org/techniques/T1547/006/"



[threat.tactic]
id = "TA0003"
name = "Persistence"
reference = "https://attack.mitre.org/tactics/TA0003/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1014"
name = "Rootkit"
reference = "https://attack.mitre.org/techniques/T1014/"

[[threat.technique]]
id = "T1055"
name = "Process Injection"
reference = "https://attack.mitre.org/techniques/T1055/"
[[threat.technique.subtechnique]]
id = "T1055.009"
name = "Proc Memory"
reference = "https://attack.mitre.org/techniques/T1055/009/"


[[threat.technique]]
id = "T1620"
name = "Reflective Code Loading"
reference = "https://attack.mitre.org/techniques/T1620/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "9.1.4"