T1547.006_kernel-modules-and-extensions

T1547.006 Kernel Modules and Extensions

Sub-technique of: T1547

High-Level Description

Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. 

When used maliciously, LKMs can be a type of kernel-mode Rootkit that run with the highest operating system privilege (Ring 0). Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.

Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux. Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies. Kexts are loaded and unloaded through kextload and kextunload commands. Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions. Developers without these privileges may still sign kexts but they will not load unless SIP is disabled. If SIP is enabled, the kext signature is verified before being added to the AuxKC.

Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions. However, kexts are still allowed as "Legacy System Extensions" since there is no System Extension for Kernel Programming Interfaces.

Adversaries can use LKMs and kexts to conduct Persistence and/or Privilege Escalation on a system. Examples have been found in the wild, and there are some relevant open source projects as well.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: macOS, Linux

What to Check

• Identify if Kernel Modules and Extensions technique is applicable to target environment
• Check macOS systems for indicators of Kernel Modules and Extensions
• Check Linux systems for indicators of Kernel Modules and Extensions
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Linux - Load Kernel Module via insmod

This test uses the insmod command to load a kernel module for Linux.

Supported Platforms: linux Elevation Required: Yes

sudo insmod #{module_path}

Dependencies:

• The kernel module must exist on disk at specified location

Atomic Test 2: MacOS - Load Kernel Module via kextload and kmutil

This test uses the kextload and kmutil commands to load and unload a MacOS kernel module.

Supported Platforms: macos Elevation Required: Yes

set -x
sudo kextload #{module_path}
kextstat 2>/dev/null | grep SoftRAID
sudo kextunload #{module_path}
sudo kmutil load -p #{module_path}
kextstat 2>/dev/null | grep SoftRAID
sudo kmutil unload -p #{module_path}

Dependencies:

• The kernel module must exist on disk at specified location

Atomic Test 3: MacOS - Load Kernel Module via KextManagerLoadKextWithURL()

This test uses the IOKit API to load a kernel module for macOS. Harcoded to use SoftRAID kext

Supported Platforms: macos Elevation Required: Yes

sudo #{exe_path}
kextstat 2>/dev/null | grep SoftRAID
sudo kextunload /Library/Extensions/SoftRAID.kext

Dependencies:

• The kernel module must exist on disk at specified location

Manual Testing

If Atomic Red Team tests are not applicable, manually verify the technique by:

1. Identify Attack Surface: Determine if the target environment is susceptible to Kernel Modules and Extensions by examining the target platforms (macOS, Linux).

2. Assess Existing Defenses: Review whether mitigations for T1547.006 are in place. If defenses are absent or misconfigured, this technique may be exploitable.

3. Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.

Remediation Guide

M1026 Privileged Account Management

Limit access to the root account and prevent users from loading kernel modules and extensions through proper privilege separation and limiting Privilege Escalation opportunities.

M1018 User Account Management

Use MDM to disable user's ability to install or approve kernel extensions, and ensure all approved kernel extensions are in alignment with policies specified in com.apple.syspolicy.kernel-extension-policy.

M1049 Antivirus/Antimalware

Common tools for detecting Linux rootkits include: rkhunter , chrootkit , although rootkits may be designed to evade certain detection tools.

M1038 Execution Prevention

Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.

Detection

Detection Strategy for Kernel Modules and Extensions Autostart Execution

Risk Assessment

CWE Categories

References

• Apple Developer Configuration Profile
• Apple Kernel Extension Deprecation
• System and kernel extensions in macOS
• GitHub Reptile
• Volatility Phalanx2
• iDefense Rootkit Overview
• Linux Loadable Kernel Module Insert and Remove LKMs
• CrowdStrike Linux Rootkit
• GitHub Diamorphine
• Securelist Ventir
• User Approved Kernel Extension Pike’s
• Linux Kernel Module Programming Guide
• Linux Kernel Programming
• Trend Micro Skidmap
• Purves Kextpocalypse 2
• RSAC 2015 San Francisco Patrick Wardle
• Synack Secure Kernel Extension Broken
• Wikipedia Loadable Kernel Module
• Atomic Red Team - T1547.006
• MITRE ATT&CK - T1547.006