T1215.md

T1215 - Kernel Modules and Extensions

Description from ATT&CK

Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. (Citation: Linux Kernel Programming) When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode [Rootkit](https://attack.mitre.org/techniques/T1014) that run with the highest operating system privilege (Ring 0). (Citation: Linux Kernel Module Programming Guide) Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. (Citation: Volatility Phalanx2) (Citation: CrowdStrike Linux Rootkit) (Citation: GitHub Reptile) (Citation: GitHub Diamorphine)

Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. (Citation: iDefense Rootkit Overview)

Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands. Several examples have been found where this can be used. (Citation: RSAC 2015 San Francisco Patrick Wardle) (Citation: Synack Secure Kernel Extension Broken) Examples have been found in the wild. (Citation: Securelist Ventir)

Atomic Tests

• Atomic Test #1 - Linux - Load Kernel Module via insmod

Atomic Test #1 - Linux - Load Kernel Module via insmod

This test uses the insmod command to load a kernel module for Linux.

Supported Platforms: Linux

Inputs:

Name	Description	Type	Default Value
temp_folder	Temp folder used to compile the code.	path	/tmp/T1215
module_source_path	Path to download Gsecdump binary file	url	PathToAtomicsFolder/T1215/src
module_path	Folder used to store the module.	path	PathToAtomicsFolder/T1215/bin/T1215.ko
module_name	Name of the kernel module name.	string	T1215

Attack Commands: Run with bash! Elevation Required (e.g. root or admin)

sudo insmod #{module_path}

Cleanup Commands:

sudo rmmod #{module_name}

Dependencies: Run with bash!

Description: The kernel module must exist on disk at specified location

Check Prereq Commands:

if [ -f #{module_path} ]; then exit 0; else exit 1; fi; 

Get Prereq Commands:

if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
cp #{module_source_path}/* #{temp_folder}/
cd #{temp_folder}; make
mv #{temp_folder}/#{module_name}.ko #{module_path}
[ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}