Skip to content

T1547.006 Kernel Modules and Extensions

Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.13 

When used maliciously, LKMs can be a type of kernel-mode Rootkit that run with the highest operating system privilege (Ring 0).12 Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.6

Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux. Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies. Kexts are loaded and unloaded through kextload and kextunload commands. Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions. Developers without these privileges may still sign kexts but they will not load unless SIP is disabled. If SIP is enabled, the kext signature is verified before being added to the AuxKC.3

Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions. However, kexts are still allowed as “Legacy System Extensions” since there is no System Extension for Kernel Programming Interfaces.2

Adversaries can use LKMs and kexts to conduct Persistence and/or Privilege Escalation on a system. Examples have been found in the wild, and there are some relevant open source projects as well.584916171014

Item Value
ID T1547.006
Sub-techniques T1547.001, T1547.002, T1547.003, T1547.004, T1547.005, T1547.006, T1547.007, T1547.008, T1547.009, T1547.010, T1547.012, T1547.013, T1547.014, T1547.015
Tactics TA0003, TA0004
Platforms Linux, macOS
Version 1.4
Created 24 January 2020
Last Modified 24 October 2025

Procedure Examples

ID Name Description
S0502 Drovorub Drovorub can use kernel modules to establish persistence.28
C0012 Operation CuckooBees During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.30
S1219 REPTILE The REPTILE rootkit is implemented as a loadable kernel module (LKM).29
S0468 Skidmap Skidmap has the ability to install several loadable kernel modules (LKMs) on infected machines.14

Mitigations

ID Mitigation Description
M1049 Antivirus/Antimalware Common tools for detecting Linux rootkits include: rkhunter 21, chrootkit 22, although rootkits may be designed to evade certain detection tools.
M1038 Execution Prevention Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.2627242325
M1026 Privileged Account Management Limit access to the root account and prevent users from loading kernel modules and extensions through proper privilege separation and limiting Privilege Escalation opportunities.
M1018 User Account Management Use MDM to disable user’s ability to install or approve kernel extensions, and ensure all approved kernel extensions are in alignment with policies specified in com.apple.syspolicy.kernel-extension-policy.1920

References

  1. Apple. (2019, May 3). Configuration Profile Reference. Retrieved September 23, 2021. ↩

  2. Apple. (n.d.). Deprecated Kernel Extensions and System Extension Alternatives. Retrieved November 4, 2020. ↩

  3. Apple. (n.d.). System and kernel extensions in macOS. Retrieved March 31, 2022. ↩

  4. Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved April 9, 2018. ↩

  5. Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018. ↩

  6. Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved September 12, 2024. ↩

  7. Henderson, B. (2006, September 24). How To Insert And Remove LKMs. Retrieved November 17, 2024. ↩

  8. Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017. ↩

  9. Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018. ↩

  10. Mikhail, K. (2014, October 16). The Ventir Trojan: assemble your MacOS spy. Retrieved April 6, 2018. ↩

  11. Pikeralpha. (2017, August 29). User Approved Kernel Extension Loading…. Retrieved September 23, 2021. ↩

  12. Pomerantz, O., Salzman, P. (2003, April 4). Modules vs Programs. Retrieved November 17, 2024. ↩

  13. Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018. ↩

  14. Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020. ↩↩

  15. Richard Purves. (2017, November 9). MDM and the Kextpocalypse . Retrieved September 23, 2021. ↩

  16. Wardle, P. (2015, April). Malware Persistence on OS X Yosemite. Retrieved April 6, 2018. ↩

  17. Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel Extension Loading’ is Broken. Retrieved November 17, 2024. ↩

  18. Wikipedia. (2018, March 17). Loadable kernel module. Retrieved April 9, 2018. ↩

  19. Apple. (2018, April 19). Technical Note TN2459: User-Approved Kernel Extension Loading. Retrieved June 30, 2020. ↩

  20. Apple. (2019, May 3). Configuration Profile Reference, Developer. Retrieved April 15, 2022. ↩

  21. Rootkit Hunter Project. (2018, February 20). The Rootkit Hunter project. Retrieved April 9, 2018. ↩

  22. Murilo, N., Steding-Jessen, K. (2017, August 23). Chkrootkit. Retrieved April 9, 2018. ↩

  23. Boelen, M. (2015, October 7). Increase kernel integrity with disabled Linux kernel modules loading. Retrieved June 4, 2020. ↩

  24. Kernel.org. (2020, February 6). Kernel Self-Protection. Retrieved June 4, 2020. ↩

  25. Pingios, A.. (2018, February 7). LKM loading kernel restrictions. Retrieved June 4, 2020. ↩

  26. Vander Stoep, J. (2016, April 5). [v3] selinux: restrict kernel module loadinglogin register. Retrieved April 9, 2018. ↩

  27. Wikibooks. (2018, August 19). Grsecurity/The RBAC System. Retrieved June 4, 2020. ↩

  28. NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020. ↩

  29. Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024. ↩

  30. Cybereason Nocturnus. (2022, May 4). Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques. Retrieved September 22, 2022. ↩