1200KM / simulation
T1547.006 Kernel Modules and Extensions — Attack Simulation
Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. When used maliciously, LKMs can be a type of…
Technique description
Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. When used maliciously, LKMs can be a type of…
At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.
Official ATT&CK definition · Detection rules and anomaly models
Documented simulation candidates
- Linux - Load Kernel Module via insmod
Procedure 687dcb93-9656-4853-9c36-9977315e9d23; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- MacOS - Load Kernel Module via KextManagerLoadKextWithURL()
Procedure f0007753-beb3-41ea-9948-760785e4c1e5; elevation required; cleanup present, not reviewed. Not executed or individually validated.
- MacOS - Load Kernel Module via kextload and kmutil
Procedure f4391089-d3a5-4dd1-ab22-0419527f2672; elevation required; cleanup not declared. Not executed or individually validated.
Connected ecosystem references
Linked tags
Detection and collection
Attack tools
No reviewed association in this snapshot.
Existing research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.