nbulischeck/tyton

[Feature Request] Kernel Module Insertion Alert

nbulischeck opened this issue · 0 comments

There is currently no alert system, but generating an alert every time a new module is inserted into the kernel would be helpful.

This can be done by:

  1. Grabbing a list of currently installed kernel modules on init.
  2. Storing that list of kernel modules in an internal linked list (preferably using the kernel's linked list implementation).
  3. Comparing each run to see whether or not a module has been loaded/unloaded.

You could probably also use a refactored form of the analyze_modules function here to search for hidden modules as well.