Suspicious Kernel Module Load from Temporary or Non-Standard Path
Identifies the loading of a Linux kernel module from a suspicious, non-standard directory such as /tmp, /dev/shm, /var/tmp, or a user's local hidden directory. Attackers often deploy rootkits and other kernel-level malware from these locations to evade detection and gain persistence. This technique is a prerequisite for kernel-level bypasses like those used by the 'Singularity' rootkit.
Microsoft Sentinel (KQL)
