AN1061
Analytic 1061
Windows
Unauthorized or anomalous loading of kernel-mode drivers or DLLs, concealed services, or abnormal modification of boot components indicative of rootkit activity.
WinEventLog:Sysmon
EventCode=6
WinEventLog:System
EventCode=7045
WinEventLog:Sysmon
EventCode=11
[DriverSignatureStatus]
Signed vs unsigned drivers; many environments restrict unsigned drivers, but some legacy systems allow them.
[TargetDirectory]
Suspicious driver or DLL drop locations, e.g., \System32\Drivers\ or \Temp\
[UserContext]
Rootkit installation via admin or SYSTEM account.
AN1062
Analytic 1062
Linux
Abnormal loading of kernel modules, direct tampering with /dev, /proc, or LD_PRELOAD behaviors hiding processes or files.
auditd:EXECVE
None
linux:osquery
file_events
linux:syslog
kmod
[MonitoredDirectories]
Directories where kernel modules or tampering could be staged (e.g., /lib/modules/).
[ModuleNamePattern]
Regex or heuristic match to anomalous module names (e.g., suspicious entropy or gibberish).
[LD_PRELOAD]
Monitor presence of suspicious preload values that mask processes or files.
AN1063
Analytic 1063
macOS
Execution of unsigned kernel extensions (KEXTs), tampering with LaunchDaemons, or userspace hooks into system libraries.
macos:unifiedlog
subsystem=com.apple.kextd
macos:osquery
launch_daemons
fs:fsevents
Extensions
[KextSignatureStatus]
Allowable level of unsigned/3rd-party kernel extensions varies by organization.
[KextLoadOrigin]
Detect whether the extension was loaded by an untrusted process or non-root user.
[AnomalousLaunchAgent]
Detection tuned based on deviation from known/approved LaunchDaemon plist files.