Kernel Modules and Extensions

{
  "id": "ATTACK:enterprise:T1547.006",
  "title": "Kernel Modules and Extensions",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1547/006",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--a1b52199-c8c5-438a-9ded-656f1d0888c6",
  "external_id": "T1547.006",
  "domain": "enterprise",
  "created": "2020-01-24T17:42:23.339Z",
  "modified": "2025-10-24T17:49:10.550Z",
  "version": "1.4",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "Apple Developer Configuration Profile",
      "url": "https://developer.apple.com/business/documentation/Configuration-Profile-Reference.pdf"
    },
    {
      "source_name": "Apple Kernel Extension Deprecation",
      "url": "https://developer.apple.com/support/kernel-extensions/"
    },
    {
      "source_name": "System and kernel extensions in macOS",
      "url": "https://support.apple.com/guide/deployment/system-and-kernel-extensions-in-macos-depa5fb8376f/web"
    },
    {
      "source_name": "GitHub Reptile",
      "url": "https://github.com/f0rb1dd3n/Reptile"
    },
    {
      "source_name": "Volatility Phalanx2",
      "url": "https://volatility-labs.blogspot.com/2012/10/phalanx-2-revealed-using-volatility-to.html"
    },
    {
      "source_name": "iDefense Rootkit Overview",
      "url": "https://www.megasecurity.org/papers/Rootkits.pdf"
    },
    {
      "source_name": "Linux Loadable Kernel Module Insert and Remove LKMs",
      "url": "https://tldp.org/HOWTO/Module-HOWTO/x197.html"
    },
    {
      "source_name": "CrowdStrike Linux Rootkit",
      "url": "https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/"
    },
    {
      "source_name": "GitHub Diamorphine",
      "url": "https://github.com/m0nad/Diamorphine"
    },
    {
      "source_name": "Securelist Ventir",
      "url": "https://securelist.com/the-ventir-trojan-assemble-your-macos-spy/67267/"
    },
    {
      "source_name": "User Approved Kernel Extension Pike’s",
      "url": "https://pikeralpha.wordpress.com/2017/08/29/user-approved-kernel-extension-loading/"
    },
    {
      "source_name": "Linux Kernel Module Programming Guide",
      "url": "https://tldp.org/LDP/lkmpg/2.4/html/x437.html"
    },
    {
      "source_name": "Linux Kernel Programming",
      "url": "https://www.tldp.org/LDP/lkmpg/2.4/lkmpg.pdf"
    },
    {
      "source_name": "Trend Micro Skidmap",
      "url": "https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"
    },
    {
      "source_name": "Purves Kextpocalypse 2",
      "url": "https://richard-purves.com/2017/11/09/mdm-and-the-kextpocalypse-2/"
    },
    {
      "source_name": "RSAC 2015 San Francisco Patrick Wardle",
      "url": "https://www.virusbulletin.com/uploads/pdf/conference/vb2014/VB2014-Wardle.pdf"
    },
    {
      "source_name": "Synack Secure Kernel Extension Broken",
      "url": "https://objective-see.org/blog/blog_0x21.html"
    },
    {
      "source_name": "Wikipedia Loadable Kernel Module",
      "url": "https://en.wikipedia.org/wiki/Loadable_kernel_module#Linux"
    }
  ]
}