Cross-source coverage
T1547.006 / ATT&CK
Boot or Logon Autostart Execution: Kernel Modules and Extensions
42 rules across 7 sources.
Showing deprecated rules · back to the default
From MITRE ATT&CK 19.2
Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.
When used maliciously, LKMs can be a type of kernel-mode Rootkit that run with the highest operating system privilege (Ring 0). Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.
Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux. Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies. Kexts are loaded and unloaded through kextload and kextunload commands. Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions. Developers without these privileges may still sign kexts but they will not load unless SIP is disabled. If SIP is enabled, the kext signature is verified before being added to the AuxKC.
Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions. However, kexts are still allowed as "Legacy System Extensions" since there is no System Extension for Kernel Programming Interfaces.
Adversaries can use LKMs and kexts to conduct Persistence and/or Privilege Escalation on a system. Examples have been found in the wild, and there are some relevant open source projects as well.
- Tactics
- Persistence · Privilege Escalation
- Platforms
- macOS · Linux
- Telemetry
-
auditd:SYSCALLlinux:osquerymacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0450
Detection Strategy for Kernel Modules and Extensions Autostart Execution
Linux Analytic 1243
Monitor kernel module load/unload activity via modprobe, insmod, rmmod, or direct manipulation of /lib/modules. Correlate with installation of kernel headers, compilation commands, or downloads of.ko files. Detect anomalies in unsigned module loading or repeated module load attempts under non-root users.
auditd:SYSCALLExecution of insmod, modprobe, or rmmod commands by non-standard users or outside expected timeframesauditd:SYSCALLAccess or modification to /lib/modules or creation of .ko fileslinux:osqueryNew or modified kernel object files (.ko) within /lib/modules directory
macOS Analytic 1244
Detect user-initiated kextload commands or modifications to /Library/Extensions. Correlate with changes to KextPolicy database or unauthorized developer signing identities. Alert on attempts to disable SIP or load legacy extensions from unsigned sources.
macos:unifiedlogkextload execution from Terminal or suspicious pathsmacos:osqueryProcesses executing kextload, spctl, or modifying kernel extension directoriesmacos:osqueryNew kext entries not signed by Apple or outside standard identifier prefixmacos:osqueryModifications to /var/db/SystemPolicyConfiguration/KextPolicy or kext_policy table
elastic/detection-rules
18 rules| Detection | Severity | Format |
|---|---|---|
| Attempt to Unload Elastic Endpoint Security Kernel Extension | High | Elastic TOML |
| Kernel Module Load from Unusual Location | High | Elastic TOML |
| Suspicious Usage of bpf_probe_write_user Helper | High | Elastic TOML |
| BPF Program or Map Load via bpftool | Medium | Elastic TOML |
| First Time Seen Driver Loaded | Medium | Elastic TOML |
| Kernel Driver Load by non-root User | Medium | Elastic TOML |
| Kernel Load or Unload via Kexec Detected | Medium | Elastic TOML |
| Kernel Module Loaded with Tainting Flags | Medium | Elastic TOML |
| Kernel Module Load via Built-in Utility | Medium | Elastic TOML |
| Loadable Kernel Module Configuration File Creation | Medium | Elastic TOML |
+ 8 more from elastic/detection-rules → showing the 10 highest-severity
splunk/security_content
9 rules| Detection | Severity | Format |
|---|---|---|
| Linux Auditd Insert Kernel Module Using Insmod Utility | Undefined | SPL |
| Linux Auditd Install Kernel Module Using Modprobe Utility | Undefined | SPL |
| Linux Auditd Kernel Module Using Rmmod Utility | Undefined | SPL |
| Linux Auditd Unload Module Via Modprobe | Undefined | SPL |
| Linux File Created In Kernel Driver Directory | Undefined | SPL |
| Linux Insert Kernel Module Using Insmod Utility | Undefined | SPL |
| Linux Install Kernel Module Using Modprobe Utility | Undefined | SPL |
| Windows Snake Malware Kernel Driver Comadmin | Undefined | SPL |
| Windows Snake Malware Service Create | Undefined | SPL |
elastic/protections-artifacts
7 rules| Detection | Severity | Format |
|---|---|---|
| Elastic Endpoint Security Kernel Extension Unload | Undefined | Elastic TOML |
| Loadable Kernel Module Loaded via Loader | Undefined | Elastic TOML |
| Loadable Kernel Module Loaded via Unusual Parent | Undefined | Elastic TOML |
| Loadable Kernel Module Load Followed by Log Clearing | Undefined | Elastic TOML |
| Loadable Kernel Module Load via Forked Memory File Descriptor | Undefined | Elastic TOML |
| New System Kext File and Immediate Load via KextLoad | Undefined | Elastic TOML |
| Potential Loadable Kernel Module Load via Memory File Descriptor | Undefined | Elastic TOML |
socfortress/Wazuh-Rules
3 rules| Detection | Severity | Format |
|---|---|---|
| Kernel module loaded from suspicious path (tmp, shm) - T1547.006 | High | Wazuh XML |
| Potential malicious kernel module (.ko) being inserted (T1547.006) | High | Wazuh XML |
| Kernel module loading detected via insmod or modprobe (T1547.006) | Medium | Wazuh XML |
SigmaHQ/sigma
2 rules| Detection | Severity | Format |
|---|---|---|
| Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator | High | Sigma |
| Loading of Kernel Module via Insmod | High | Sigma |
Wazuh Core Ruleset
2 rules| Detection | Severity | Format |
|---|---|---|
| Signed but untrusted kernel module was loaded | High | Wazuh XML |
| Unsigned kernel module was loaded | High | Wazuh XML |
Azure/Azure-Sentinel
1 rule| Detection | Severity | Format |
|---|---|---|
| List all the VScode Extensions which are installed on a user system | Undefined | KQL |