Quick systemtap to log which processes attempt to load kernel modules.

log-module-loads.stap

/*  stap -vv log-module-loads.stap */

probe syscall.init_module {

        cmdline = cmdline_str()
        time = ctime(gettimeofday_s());
        printf("%s - Process %s[%d] is loading a module via: '%s'\n", time, pexecname(), ppid(), cmdline  );

}