Engage Goals: EGO0001 Expose
Engage Approach: EAP0002 Detect
Engage Actions: EAC0002 Network Monitoring, EAC0015 Information Manipulation
Name of Element: Linux Kernel Module Deception
Description of Element:
Goal: Detect rootkit activity by presenting a deceptive view of kernel modules.
Approach: Monitoring kernel module activity for anomalies.
This element involves creating a deceptive kernel module that mimics legitimate modules but provides false information when queried by malicious actors.
Technical Context:
This element leverages the Linux kernel’s modular architecture. It intercepts system calls related to module loading and unloads, presenting a deceptive view of the kernel’s state.
Other:
This element can be particularly effective against advanced persistent threats (APTs) that attempt to hide their presence by manipulating kernel modules.