BUMSRAKETE Post-Exploitation: kldload from Non-Standard Path or Suspicious Lineage

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects potentially unauthorized or malicious loading of kernel modules on FreeBSD systems using the kldload command. The rule identifies suspicious activity by flagging modules loaded from non-standard directories, kldload processes spawned by untrusted parent processes (like web servers, shells, or scripts), and instances where the process was invoked with sudo/su by non-root users.