Manual insmod/modprobe kernel module load indicative of rootkit LKM insertion
Detects the execution of insmod or modprobe commands used to manually insert a Linux kernel module (LKM). This behavior is commonly associated with kernel-mode rootkit installation, where adversaries attempt to gain persistence or hide malicious activity from standard system enumeration utilities.
Microsoft Sentinel (KQL)
