Kernel Module Load via insmod
Detects the loading of kernel modules using insmod. Executing this from within a container or unexpected context often indicates abuse of CAP_SYS_MODULE to load malicious rootkits or reverse shells for privilege escalation or container escape.
Microsoft Sentinel (KQL)
