T1547.006 — Kernel Modules and Extensions

Tactics: Persistence, Privilege Escalation · Platforms: macOS, Linux

Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one…

Sub-technique of Boot or Logon Autostart Execution (T1547).

Sigma detection rules (2)

T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions

title: "T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions"
id: bab2ccae-29ea-4445-b52c-33b62bfae61b
description: 'Detection Strategy for Kernel Modules and Extensions Autostart Execution. The prior version declared logsource category file_event despite matching an EXECVE (process-creation) record, and it checked exe (the path of the insmod/modprobe loader binary itself, normally /sbin/insmod) for /tmp/ or /dev/shm/ rather than the actual kernel-module-file argument passed to the loader - so the intended "module loaded from a suspicious path" logic would almost never match real attacker behavior, since the loader binary itself is almost always installed at its standard system path regardless of where the module file it loads comes from. Fixed logsource to process_creation and now checks the module-path argument (a1) for a world-writable staging location. Tune using: UserContext, TimeWindow, FilePathRegex.'
references:
  - https://attack.mitre.org/techniques/T1547/006
author: Shahrukh Khan
date: 2026-01-20
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.006

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/insmod'
      - '/modprobe'
  selection_suspicious_module_path:
    a1|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'

  condition: selection and selection_suspicious_module_path

falsepositives:
  - Legitimate kernel-module loading from non-standard paths is rare outside development/testing of custom drivers; almost always warrants review outside a known dev workflow.

level: critical

T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions

title: "T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions"
id: 7226ca52-9dfc-4b8e-a665-f07d72d0fd6a
description: 'Detection Strategy for Kernel Modules and Extensions Autostart Execution. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DeveloperIDAllowlist, KextLoadTimeWindow, SignatureCheckFlag.'
references:
  - https://attack.mitre.org/techniques/T1547/006
author: Shahrukh Khan
date: 2026-04-20
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1547.006

logsource:
  product: macos

detection:
  selection:
    Image|endswith:
      - '/kmutil'
      - '/kextload'
  selection_args:
    CommandLine|contains:
      - 'load'
      - 'staging'
  condition: selection and selection_args

falsepositives:
  - Legitimate hardware drivers such as virtualization software and printer kexts load through the same kmutil and kextload utilities, so this should be scoped to kexts signed by a developer ID not present in an approved allowlist.

level: critical

Related sub-techniques

Explore