Kernel Module Loading Activity

Danny Y@zendannyy

•updated Apr 22, 2026•0•260

Detects attempts to load kernel modules using common utilities like 'insmod', 'modprobe', or 'kmod'. This activity can be indicative of an attacker attempting to establish persistence, elevate privileges, or hide malicious activity by loading custom kernel modules.