Custom Wazuh decoders and rules for LKRG (Linux Kernel Runtime Guard) — surface kernel integrity violations, privilege escalation attempts, and exploit detection events directly in your SIEM.
LKRG is a loadable kernel module that detects runtime integrity violations and exploitation attempts at the kernel level. It monitors:
- kernel code/data integrity
- process credential changes (privilege escalation)
- SELinux/AppArmor enforcement bypass attempts
- exploit technique detection (ROP, JOP, ret2usr, etc.)
It runs on mainline and distro kernels from RHEL7 onwards without kernel patching.
# Copy decoders
cp lkrg_decoders.xml /var/ossec/etc/decoders/
# Copy rules
cp lkrg_rules.xml /var/ossec/etc/rules/
# Reload rules without restart
wazuh-reload-rules
# or
systemctl restart wazuh-manager| LKRG event | Wazuh rule | Description |
|---|---|---|
LKRG: ALERT |
lkrg_alert | Kernel integrity violation |
LKRG: EXPLOIT |
lkrg_exploit | Exploitation attempt blocked |
LKRG: TASK |
lkrg_task | Process credential tampering |
LKRG: INIT |
lkrg_init | LKRG module load/unload |
- Adam 'pi3' Zabrocki — LKRG author (pi3.com.pl)
- LKRG project