Detects when a Linux process triggers a kernel module load that is tainted (taint_flags present). A tainted kernel module is not from the official kernel tree or is modified, which can indicate persistence mechanisms or evasion by an attacker (e.g., rootkits or hidden modules). The rule targets Linux endpoints by watching process start events for load_module actions where the taint_flags field is populated, signaling potential kernel-level compromise. It maps to MITRE techniques related to persistence (Kernel Modules and Extensions, T1547.006), defense evasion (Rootkit, T1014), and general autostart execution (Boot or Logon Autostart, T1547; TA0004/TA0005). The detection relies on the presence of process.Ext.load_module.taint_flags in the Linux process event data and is intended for use with Elastic Defend on Linux endpoints via Elastic Agent integration. The rule is categorized as medium severity with a risk score of 47. It is meant for threat detection and incident response, prompting containment, evidence preservation, and remediation of tainted modules. The accompanying guide emphasizes rapid investigation of whether the module is expected, collection of module metadata (path, hash, signer, build), log review around load time for prior privileged activity, and assessment of post-load impact (hidden processes, abnormal hooks, startup persistence). Remediation includes isolating the host, removing the module and related load paths, rebuilding from a trusted baseline, and enforcing kernel protections (Secure Boot, module signing, lockdown mode). Post-incident actions include credential rotation and cross-host checks. The setup notes require Elastic Defend integration via Fleet and Elastic Agent on Linux. This rule provides a focused, high-signal indicator for kernel-level tampering and is best used as part of a broader Linux endpoint monitoring strategy that includes kernel integrity checks and signed-kernel enforcement.