Kernel Modules and Extensions

May 1, 2024 ยท View on GitHub

ID F0010
Objective(s) Persistence, Privilege Escalation
Related ATT&CK Techniques Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006)
Version 2.3
Created 1 August 2019
Last Modified 30 April 2024

Kernel Modules and Extensions

Malware may use loadable kernel modules to persist on a system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. Malware may try to hide drivers or modules by creating them without a name.

See ATT&CK: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006).

Methods

NameIDDescription
Device DriverF0010.001Allows kernel to access hardware connected to the system.

Use in Malware

NameDateMethodDescription
Drovorub2020--Drovorub uses a kernel module rootkit for loading and for persistence. [1]

Detection

Tool: CAPEMappingAPIs
volatility_devicetree_1Kernel Modules and Extensions (F0010)--
volatility_devicetree_1Kernel Modules and Extensions::Device Driver (F0010.001)--
driver_loadKernel Modules and Extensions (F0010)NtLoadDriver

References

[1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF