Kernel Modules and Extensions
May 1, 2024 ยท View on GitHub
| ID | F0010 |
| Objective(s) | Persistence, Privilege Escalation |
| Related ATT&CK Techniques | Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006) |
| Version | 2.3 |
| Created | 1 August 2019 |
| Last Modified | 30 April 2024 |
Kernel Modules and Extensions
Malware may use loadable kernel modules to persist on a system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. Malware may try to hide drivers or modules by creating them without a name.
See ATT&CK: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006).
Methods
| Name | ID | Description |
|---|---|---|
| Device Driver | F0010.001 | Allows kernel to access hardware connected to the system. |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Drovorub | 2020 | -- | Drovorub uses a kernel module rootkit for loading and for persistence. [1] |
Detection
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| volatility_devicetree_1 | Kernel Modules and Extensions (F0010) | -- |
| volatility_devicetree_1 | Kernel Modules and Extensions::Device Driver (F0010.001) | -- |
| driver_load | Kernel Modules and Extensions (F0010) | NtLoadDriver |
References
[1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF