Rogue Module: Audit the Kernel and Find the Unsigned Rootkit

Loadable kernel modules run in ring 0, so a threat actor who can load one owns the box — and hides from userland tools. Your job is to tell an expected module from an abused one. A host's module inventory was captured to /root/case/: the /proc/modules dump, per-module modinfo output, and the kernel dmesg ring buffer.

Expected behavior: a legitimate module is either in-tree (intree: Y) or a properly SIGNED vendor driver (it has a signer: line), and it lives under /lib/modules/<version>/. Abuse: an attacker side-loads an UNSIGNED, out-of-tree .ko from a hidden path — the kernel taints (module verification failed, module license 'unspecified' taints kernel) and no signature is present. That is the profile of an LKM rootkit or backdoor driver.

The trap: a legitimate vendor driver (GPU/hypervisor/filesystem) is ALSO out-of-tree (intree: N) — but it is signed, so it is not the rogue. A rule that flags 'any out-of-tree module' raises a false positive on it. The rogue is the module that is out-of-tree AND unsigned.

1. Identify the rogue module's name and record it in /root/case/rogue_module.txt.

2. Write a detector at /root/detect.sh that scans the captured modinfo files in /root/case/modinfo/ and prints the modules that are out-of-tree AND unsigned, one bare module name per line. Grading runs bash /root/detect.sh, and also re-runs it against a second, unseen host's capture as bash /root/detect.sh <casedir> — so read the files from the directory given as the first argument, defaulting to /root/case (${1:-/root/case}/modinfo/), not from a hardcoded path or module name. MITRE ATT&CK: T1547.006, T1014.