# Ensure kernel module loading unloading and modification is collected

Necessity: Monitoring kernel module loading, unloading, and modification is critical for detecting advanced threats. Attackers often use malicious Loadable Kernel Modules (LKMs), or rootkits, to gain persistent, privileged access to a system while hiding their activities. By logging all attempts to modify the kernel via modules, administrators can create an audit trail that is essential for identifying unauthorized system modifications and for forensic analysis during an incident investigation. Failure to collect this data creates a significant blind spot in system security monitoring.

Auditing and Remediation: The audit script verifies that the `auditd` service is configured to watch for the execution of module-management commands (`insmod`, `rmmod`, `modprobe`) and to log the underlying system calls (`init_module`, `delete_module`) that perform these actions. The remediation script ensures these specific rules are written to a persistent configuration file and that the `auditd` service loads them, thereby activating this monitoring capability.

Recommended State Rationale: A state of 'present' is mandated across all security levels (Basic, Moderate, and Strict) because this control is foundational. There is no lesser or partial state that provides meaningful security. Either kernel module activity is monitored, or it is not. Given the high risk associated with unauthorized kernel modifications, this is considered a mandatory baseline control for any secure system. Therefore, the recommended state is consistently 'present' to ensure this critical security gap is closed.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['present']` |
| **Moderate** | `['present']` |
| **Strict** | `['present']` |
| **Type** | `ENUM` |

## Audit Script Working

shell script that checks if the auditd rules for kernel module loading are correctly configured. The script must query the active audit rules (e.g., using `auditctl -l`) and verify the presence of the following rules: `-w /sbin/insmod -p x -k modules`, `-w /sbin/rmmod -p x -k modules`, `-w /sbin/modprobe -p x -k modules`, and a rule matching `-a always,exit -F arch=b[32|64] -S init_module,delete_module -k modules`. The script should output only the string 'present' if all rules are found, and 'absent' otherwise.

## Remediation Script Working

shell script that accepts a single argument to configure the auditd rules for kernel module monitoring. If the argument is 'present', the script must add the following lines to a persistent audit rule file (e.g., `/etc/audit/rules.d/modules.rules`): `-w /sbin/insmod -p x -k modules`, `-w /sbin/rmmod -p x -k modules`, `-w /sbin/modprobe -p x -k modules`, `-a always,exit -F arch=b64 -S init_module -S delete_module -k modules`, and `-a always,exit -F arch=b32 -S init_module -S delete_module -k modules`. After adding the rules, it must reload the auditd configuration (e.g., using `augenrules --load`). The script must output `true` on successful application or `false` on failure.

