attack_technique: T1014
display_name: Rootkit
atomic_tests:
- name: Loadable Kernel Module based Rootkit
  auto_generated_guid: dfb50072-e45a-4c75-a17e-a484809c8553
  description: |
    Loadable Kernel Module based Rootkit
  supported_platforms:
  - linux
  input_arguments:
    rootkit_source_path:
      description: Path to the rootkit source. Used when prerequistes are fetched.
      type: Path
      default: PathToAtomicsFolder/T1014/src/Linux
    rootkit_path:
      description: Path To rootkit
      type: String
      default: PathToAtomicsFolder/T1014/bin/T1014.ko
    rootkit_name:
      description: Module name
      type: String
      default: T1014
    temp_folder:
      description: Temp folder used to compile the code. Used when prerequistes are fetched.
      type: Path
      default: /tmp/T1014
  dependency_executor_name: bash
  dependencies:
  - description: |
      The kernel module must exist on disk at specified location (#{rootkit_path})
    prereq_command: |
      if [ -f #{rootkit_path} ]; then exit 0; else exit 1; fi;
    get_prereq_command: |
      if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
      cp #{rootkit_source_path}/* #{temp_folder}/
      cd #{temp_folder}; make
      mv #{temp_folder}/#{rootkit_name}.ko #{rootkit_path}
      [ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
  executor:
    command: |
      sudo insmod #{rootkit_path}
    cleanup_command: |
      sudo rmmod #{rootkit_name}
    name: sh
    elevation_required: true
- name: Loadable Kernel Module based Rootkit
  auto_generated_guid: 75483ef8-f10f-444a-bf02-62eb0e48db6f
  description: |
    Loadable Kernel Module based Rootkit
  supported_platforms:
  - linux
  input_arguments:
    rootkit_source_path:
      description: Path to the rootkit source. Used when prerequistes are fetched.
      type: Path
      default: PathToAtomicsFolder/T1014/src/Linux
    rootkit_path:
      description: Path To rootkit
      type: String
      default: PathToAtomicsFolder/T1014/bin/T1014.ko
    rootkit_name:
      description: Module name
      type: String
      default: T1014
    temp_folder:
      description: Temp folder used to compile the code. Used when prerequistes are fetched.
      type: Path
      default: /tmp/T1014
  dependency_executor_name: bash
  dependencies:
  - description: |
      The kernel module must exist on disk at specified location (#{rootkit_path})
    prereq_command: |
      if [ -f /lib/modules/$(uname -r)/#{rootkit_name}.ko ]; then exit 0; else exit 1; fi;
    get_prereq_command: |
      if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
      cp #{rootkit_source_path}/* #{temp_folder}/
      cd #{temp_folder}; make        
      sudo cp #{temp_folder}/#{rootkit_name}.ko /lib/modules/$(uname -r)/
      [ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
      sudo depmod -a
  executor:
    command: |
      sudo modprobe #{rootkit_name}
    cleanup_command: |
      sudo modprobe -r #{rootkit_name}
      sudo rm /lib/modules/$(uname -r)/#{rootkit_name}.ko
      sudo depmod -a
    name: sh
    elevation_required: true
