# T1547.006 - Kernel Modules and Extensions
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1547/006)
<blockquote>Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) 

When used maliciously, LKMs can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)

Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through <code>kextload</code> and <code>kextunload</code> commands. Since macOS Catalina 10.15, kernel extensions have been deprecated on macOS systems.(Citation: Apple Kernel Extension Deprecation)

Adversaries can use LKMs and kexts to covertly persist on a system and elevate privileges. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)(Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken)(Citation: Securelist Ventir) (Citation: Trend Micro Skidmap)</blockquote>

## Atomic Tests

- [Atomic Test #1 - Linux - Load Kernel Module via insmod](#atomic-test-1---linux---load-kernel-module-via-insmod)


<br/>

## Atomic Test #1 - Linux - Load Kernel Module via insmod
This test uses the insmod command to load a kernel module for Linux.

**Supported Platforms:** Linux


**auto_generated_guid:** 687dcb93-9656-4853-9c36-9977315e9d23





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| module_name | Name of the kernel module name. | String | T1547006|
| module_path | Folder used to store the module. | Path | /tmp/T1547.006/T1547006.ko|
| temp_folder | Temp folder used to compile the code. | Path | /tmp/T1547.006|
| module_source_path | Path to download Gsecdump binary file | Url | PathToAtomicsFolder/T1547.006/src|


#### Attack Commands: Run with `bash`!  Elevation Required (e.g. root or admin) 


```bash
sudo insmod #{module_path}
```

#### Cleanup Commands:
```bash
sudo rmmod #{module_name}
[ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
```



#### Dependencies:  Run with `bash`!
##### Description: The kernel module must exist on disk at specified location
##### Check Prereq Commands:
```bash
if [ -f #{module_path} ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```bash
if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
cp #{module_source_path}/* #{temp_folder}/
cd #{temp_folder}; make
if [ ! -f #{module_path} ]; then mv #{temp_folder}/#{module_name}.ko #{module_path}; fi;
```




<br/>
