Linux Kernel Module Injection Detected

Description

Inject Linux Kernel Modules from containers using insmod or modprobe with init_module and finit_module syscalls, given the precondition of sys_module effective capabilities. Profile the environment and consider allowed_container_images_loading_kernel_module to reduce noise and account for legitimate cases.

Query · falco

kernel_module_load and container and thread.cap_effective icontains sys_module and not container.image.repository in (allowed_container_images_loading_kernel_module)

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro kernel_module_load
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Linux Kernel Module injection from container | parent_exepath=%proc.pexepath gparent=%proc.aname[2] gexepath=%proc.aexepath[2] module=%proc.args res=%evt.res evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Linux Kernel Module Injection Detected · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Linux Kernel Module Injection Detected
desc: 'Inject Linux Kernel Modules from containers using insmod or modprobe with init_module
  and finit_module syscalls, given the precondition of sys_module effective capabilities.
  Profile the environment and consider allowed_container_images_loading_kernel_module
  to reduce noise and account for legitimate cases.

  '
condition: 'kernel_module_load and container and thread.cap_effective icontains sys_module
  and not container.image.repository in (allowed_container_images_loading_kernel_module)

  '
output: Linux Kernel Module injection from container | parent_exepath=%proc.pexepath
  gparent=%proc.aname[2] gexepath=%proc.aexepath[2] module=%proc.args res=%evt.res
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: WARNING
tags:
- maturity_stable
- host
- container
- process
- mitre_persistence
- TA0003

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.