---
title: Deprecated - Creation of Kernel Module
description: Identifies activity related to loading kernel modules on Linux via creation of new ko files in the LKM directory. Rule type: eql Rule indices: logs-endpoint.events.*,...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/_deprecated/persistence_creation_of_kernel_module
products:
  - Elastic Security
---

# Deprecated - Creation of Kernel Module
<warning>
  This rule has been deprecated as of 2026/02/04.
</warning>

Identifies activity related to loading kernel modules on Linux via creation of new ko files in the LKM directory.
**Rule type**: eql
**Rule indices**:
- logs-endpoint.events.*
- endgame-*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 60m
**Searches indices from**: `now-119m`
**Maximum alerts per execution**: 100
**References**:
**Tags**:
- Domain: Endpoint
- OS: Linux
- Use Case: Threat Detection
- Tactic: Persistence
- Rule Type: BBR
- Data Source: Elastic Defend
- Data Source: Elastic Endgame

**Version**: 6
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Rule Query

```eql
file where host.os.type == "linux" and event.type in ("change", "creation") and file.path : "/lib/modules/*" and
file.extension == "ko" and not process.name : (
  "dpkg", "systemd", "falcon-sensor*", "dnf", "yum", "rpm", "cp"
)
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Persistence
  - Id: TA0003
  - Reference URL: [[https://attack.mitre.org/tactics/TA0003/](https://attack.mitre.org/tactics/TA0003/)](https://attack.mitre.org/tactics/TA0003/)
- Technique:
  - Name: Boot or Logon Autostart Execution
  - Id: T1547
  - Reference URL: [[https://attack.mitre.org/techniques/T1547/](https://attack.mitre.org/techniques/T1547/)](https://attack.mitre.org/techniques/T1547/)
- Sub Technique:
  - Name: Kernel Modules and Extensions
  - Id: T1547.006
  - Reference URL: [[https://attack.mitre.org/techniques/T1547/006/](https://attack.mitre.org/techniques/T1547/006/)](https://attack.mitre.org/techniques/T1547/006/)