Add rule for insert or remove rootkit

rules/linux/process_creation/proc_creation_lnx_device_driver_insert_remove.yml

@@ -0,0 +1,28 @@
+title: Detect Adding Kernel Modules - Linux
+id: 85b78882-a58d-405f-bbb3-201d41812e8c
+status: test
+description: Adversaries may attempt to insert/remove rootkits onto a victim host. This rule detects the use of commands such as 'insmod', 'modprobe', and 'rmmod' which are commonly used to load or remove kernel modules.
+references:
+    - https://attack.mitre.org/techniques/T1014/
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1014/T1014.md
+author: CheraghiMilad
+date: 2024-12-08
+tags:
+    - attack.defense-evasion
+    - attack.t1014
+logsource:
+    category: process_creation
+    product: linux
+detection:
+    selection:
+        Image|endswith:
+            - '/kmod'
+            - '/sudo'
+        CommandLine|contains:
+            - 'insmod'
+            - 'rmmod'
+            - 'modprobe'
+    condition: selection
+falsepositives:
+    - Administrative tasks such as legitimate system administration involving device driver modules.
+level: medium