Detecting and Capturing Kernel Modules with Tracee and eBPF

This blog describes the risks posed by malicious Linux kernel modules (kernel rootkits), how attackers load modules from memory to evade filesystem-based detection, the heightened danger for containerized/cloud environments (host escape and cross-container compromise), and demonstrates how Tracee can detect and dump volatile kernel modules for forensic analysis; it also references TeamTNT and the Diamorphine rootkit and mentions Aqua CNDR detection capabilities.