value:  Malware trying to get kernel access may run commands before loading a malicious module, and some of these include ‘modprobe’, ‘insmod’, ‘lsmod’, ‘rmmod’, and ‘modinfo’. 
name: Boot or Logon Autostart Execution: Kernel Modules And Extensions