attack_technique: T1547.006
display_name: 'Boot or Logon Autostart Execution: Kernel Modules and Extensions'
atomic_tests:
- name: Linux - Load Kernel Module via insmod
  auto_generated_guid: 687dcb93-9656-4853-9c36-9977315e9d23
  description: |
    This test uses the insmod command to load a kernel module for Linux.
  supported_platforms:
  - linux
  input_arguments:
    module_name:
      description: Name of the kernel module name.
      type: String
      default: T1547006
    module_path:
      description: Folder used to store the module.
      type: Path
      default: /tmp/T1547.006/T1547006.ko
    temp_folder:
      description: Temp folder used to compile the code.
      type: Path
      default: /tmp/T1547.006
    module_source_path:
      description: Path to download Gsecdump binary file
      type: Url
      default: PathToAtomicsFolder/T1547.006/src
  dependency_executor_name: bash
  dependencies:
  - description: |
      The kernel module must exist on disk at specified location
    prereq_command: |
      if [ -f #{module_path} ]; then exit 0; else exit 1; fi;
    get_prereq_command: |
      if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
      cp #{module_source_path}/* #{temp_folder}/
      cd #{temp_folder}; make
      if [ ! -f #{module_path} ]; then mv #{temp_folder}/#{module_name}.ko #{module_path}; fi;
  executor:
    command: |
      sudo insmod #{module_path}
    cleanup_command: |
      sudo rmmod #{module_name}
      [ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
    name: bash
    elevation_required: true
