Rootkit Installed via Remote SSH Session

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to install a kernel module (rootkit) on a Linux system via an SSH session. It specifically looks for the 'insmod' command followed by a '.ko' file extension within TCP traffic destined for port 22 (SSH). This combination suggests an attacker is trying to load a malicious kernel object.