TA0003 · PERSISTENCE
Kernel Modules and Extensions
Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.
Detect it with
Loading, unloading, and manipulating modules on Linux systems can be detected by monitoring for the following commands: modprobe , insmod , lsmod , rmmod , or modinfo LKMs are typically loaded into /lib/modules and have had the extension .ko ("kernel object") since version 2.6…
Why it matters on shift
Kernel Modules and Extensions is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.
Kill-chain context