tfMITRE ATT&CK sub-technique

Kernel Modules and Extensions T1547.006

sub-technique of T1547 Boot or Logon Autostart Execution

Tactics: Persistence, Privilege Escalation
Platforms: macOS, Linux
Version: 1.4
Created: 24 January 2020
Last modified: 24 October 2025
Contributors: Wayne Silva, F-Secure Countercept; Anastasios Pingios; Jeremy Galloway; Red Canary; Eric Kaiser @ideologysec

Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 23%

Detection rules77th percentile · 77% of ATT&CK techniques have this many detection rules written or fewer.

Kernel Modules and Extensions MITRE reference T1547.006

72nd pctamong all ATT&CK techniques for number of campaigns

1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

Operation CuckooBeesC0012 ↗

During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.1

2019–2022

All 1 campaigns for this technique

Offense vs defense T1547.006

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 2Splunk ESCU (cumulative) · 9

first rule: 2021 Q4 · 1 of 1 campaigns plotted

Kernel Modules and Extensions detection strategy DET0450

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Kernel Modules and Extensions Autostart Execution

Enterprise

2 platforms

AN1243 · Linux

Monitor kernel module load/unload activity via modprobe, insmod, rmmod, or direct manipulation of /lib/modules. Correlate with installation of kernel headers, compilation commands, or downloads of .ko files. Detect anomalies in unsigned module loading or repeated module load attempts under non-root users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	auditd:SYSCALL	Access or modification to /lib/modules or creation of .ko files
File ModificationDC0061	linux:osquery	New or modified kernel object files (.ko) within /lib/modules directory
Command ExecutionDC0064	auditd:SYSCALL	Execution of insmod, modprobe, or rmmod commands by non-standard users or outside expected timeframes

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Scope detection to non-root or unexpected users performing module-related activity
TimeWindow	Limit alerts to module activity outside approved change windows
FilePathRegex	Adjust regex pattern for directories to monitor depending on kernel version or distro

AN1244 · macOS

Detect user-initiated kextload commands or modifications to /Library/Extensions. Correlate with changes to KextPolicy database or unauthorized developer signing identities. Alert on attempts to disable SIP or load legacy extensions from unsigned sources.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Kernel Module LoadDC0031	macos:osquery	New kext entries not signed by Apple or outside standard identifier prefix
Process CreationDC0032	macos:osquery	Processes executing kextload, spctl, or modifying kernel extension directories
File ModificationDC0061	macos:osquery	Modifications to /var/db/SystemPolicyConfiguration/KextPolicy or kext_policy table
Command ExecutionDC0064	macos:unifiedlog	kextload execution from Terminal or suspicious paths

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DeveloperIDAllowlist	Approved developer IDs whose kexts should not trigger alerts
KextLoadTimeWindow	Threshold for detecting kext loads outside standard install/update operations
SignatureCheckFlag	Flag to enforce strict signing checks depending on SIP status

Antivirus/AntimalwareM1049

Common tools for detecting Linux rootkits include: rkhunter , chrootkit , although rootkits may be designed to evade certain detection tools.

Execution PreventionM1038

Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.

Privileged Account ManagementM1026

Limit access to the root account and prevent users from loading kernel modules and extensions through proper privilege separation and limiting Privilege Escalation opportunities.

User Account ManagementM1018

Use MDM to disable user's ability to install or approve kernel extensions, and ensure all approved kernel extensions are in alignment with policies specified in com.apple.syspolicy.kernel-extension-policy.

Tests4Executorsbash 3 · PowerShell 1Need elevation4 of 4Have prerequisites3Have cleanup3Platformslinux, macos, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Linux - Load Kernel Module via insmod

linux

bash

Required

Yes

This test uses the insmod command to load a kernel module for Linux.

Input arguments

Name	Type	Default	Description
module_name	string	T1547006	Name of the kernel module name.
module_path	path	/tmp/T1547.006/T1547006.ko	Folder used to store the module.
temp_folder	path	/tmp/T1547.006	Temp folder used to compile the code.
module_source_path	path	PathToAtomicsFolder/T1547.006/src	Path to download Gsecdump binary file

Attack command

sudo insmod #{module_path}

Cleanup command

sudo rmmod #{module_name}
[ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}

Prerequisite

The kernel module must exist on disk at specified location

Check

if [ -f #{module_path} ]; then exit 0; else exit 1; fi;

Satisfy

if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
cp #{module_source_path}/* #{temp_folder}/
cd #{temp_folder}; make
if [ ! -f #{module_path} ]; then mv #{temp_folder}/#{module_name}.ko #{module_path}; fi;

GUID1774188e-38ff-453e-9f09-300997a9df97

MacOS - Load Kernel Module via kextload and kmutil

macos

bash

Required

—

This test uses the kextload and kmutil commands to load and unload a MacOS kernel module.

Input arguments

Name	Type	Default	Description
module_path	path	/Library/Extensions/SoftRAID.kext	Folder used to store the module.

Attack command

set -x
sudo kextload #{module_path}
kextstat 2>/dev/null | grep SoftRAID
sudo kextunload #{module_path}
sudo kmutil load -p #{module_path}
kextstat 2>/dev/null | grep SoftRAID
sudo kmutil unload -p #{module_path}

Prerequisite

The kernel module must exist on disk at specified location

Check

if [ -d #{module_path} ] ; then exit 0; else exit 1 ; fi

Satisfy

exit 1

GUID119c001f-e390-4fa7-a376-98aa625b9e59

MacOS - Load Kernel Module via KextManagerLoadKextWithURL()

macos

bash

Required

Yes

This test uses the IOKit API to load a kernel module for macOS. Harcoded to use SoftRAID kext

Input arguments

Name	Type	Default	Description
exe_path	path	/tmp/T1547006_iokit_loader	Folder used to store the module.
src_path	path	PathToAtomicsFolder/T1547.006/src/macos_kextload.c	Folder used to store the module.

Attack command

sudo #{exe_path}
kextstat 2>/dev/null | grep SoftRAID
sudo kextunload /Library/Extensions/SoftRAID.kext

Cleanup command

rm -f #{exe_path}

Prerequisite

The kernel module must exist on disk at specified location

Check

if [ -f "#{exe_path}" ]; then exit 0 ; else exit 1; fi

Satisfy

cc -o #{exe_path} #{src_path} -framework IOKit -framework Foundation

GUID3b72af97-a878-485d-8374-abffcc1fed95

Snake Malware Kernel Driver Comadmin

windows

PowerShell

Required

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Kernel Modules and Extensions detections T1547.006

11 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 23%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs