{"id":"T1547.006","name":"Kernel Modules and Extensions","url":"https://attack.mitre.org/techniques/T1547/006","tactics":["persistence","privilege-escalation"],"platforms":["macOS","Linux"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0450","stix_id":"x-mitre-detection-strategy--df1da8e4-cabf-42f0-8f5f-2fa8086b1423","name":"Detection Strategy for Kernel Modules and Extensions Autostart Execution","url":"https://attack.mitre.org/detectionstrategies/DET0450","analytics":[{"id":"AN1243","stix_id":"x-mitre-analytic--c221d379-1dcb-4ca7-908e-59f6ed7afaed","name":"Analytic 1243","description":"Monitor kernel module load/unload activity via modprobe, insmod, rmmod, or direct manipulation of /lib/modules. Correlate with installation of kernel headers, compilation commands, or downloads of .ko files. Detect anomalies in unsigned module loading or repeated module load attempts under non-root users.","url":"https://attack.mitre.org/detectionstrategies/DET0450#AN1243","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"Execution of insmod, modprobe, or rmmod commands by non-standard users or outside expected timeframes","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"Access or modification to /lib/modules or creation of .ko files","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-syscall"},{"name":"linux:osquery","channel":"New or modified kernel object files (.ko) within /lib/modules directory","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"linux-osquery"}],"mutable_elements":[{"field":"UserContext","description":"Scope detection to non-root or unexpected users performing module-related activity"},{"field":"TimeWindow","description":"Limit alerts to module activity outside approved change windows"},{"field":"FilePathRegex","description":"Adjust regex pattern for directories to monitor depending on kernel version or distro"}],"live":true,"detection_strategies":["DET0450"],"techniques":["T1547.006"]},{"id":"AN1244","stix_id":"x-mitre-analytic--092689c7-be8a-4d11-99d8-7dd96afa938d","name":"Analytic 1244","description":"Detect user-initiated kextload commands or modifications to /Library/Extensions. Correlate with changes to KextPolicy database or unauthorized developer signing identities. Alert on attempts to disable SIP or load legacy extensions from unsigned sources.","url":"https://attack.mitre.org/detectionstrategies/DET0450#AN1244","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"kextload execution from Terminal or suspicious paths","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"Processes executing kextload, spctl, or modifying kernel extension directories","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"macos-osquery"},{"name":"macos:osquery","channel":"New kext entries not signed by Apple or outside standard identifier prefix","data_component":"DC0031","data_component_name":"Kernel Module Load","log_source_slug":"macos-osquery"},{"name":"macos:osquery","channel":"Modifications to /var/db/SystemPolicyConfiguration/KextPolicy or kext_policy table","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"DeveloperIDAllowlist","description":"Approved developer IDs whose kexts should not trigger alerts"},{"field":"KextLoadTimeWindow","description":"Threshold for detecting kext loads outside standard install/update operations"},{"field":"SignatureCheckFlag","description":"Flag to enforce strict signing checks depending on SIP status"}],"live":true,"detection_strategies":["DET0450"],"techniques":["T1547.006"]}],"live":true,"version":"1.0","techniques":["T1547.006"]}],"sigma_rules":[{"id":"106d7cbd-80ff-4985-b682-a7043e5acb72","title":"Loading of Kernel Module via Insmod","author":"Pawel Mazur","status":"test","level":"high","date":"2021-11-02","modified":"2022-12-25","description":"Detects loading of kernel modules with insmod command.\nLoadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.\nAdversaries may use LKMs to obtain persistence within the system or elevate the privileges.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.006/T1547.006.md","https://linux.die.net/man/8/insmod","https://man7.org/linux/man-pages/man8/kmod.8.html"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.persistence","attack.privilege-escalation","attack.t1547.006"],"path":"rules/linux/auditd/syscall/lnx_auditd_load_module_insmod.yml","techniques":["T1547.006"],"cves":[]},{"id":"474b415a-d917-4f3b-8c62-9e1a0d5f7b48","title":"Authencesn Crypto Module Load via Modprobe - Copy-Fail Indicator","author":"Gene Kazimiarovich","status":"experimental","level":"high","date":"2026-05-09","modified":null,"description":"Detects kernel auto-loading of the authencesn crypto module via modprobe\nThis occurs when user-space code creates an AF_ALG socket and binds the authencesn AEAD cipher\n(e.g., authencesn(hmac(sha256),cbc(aes))). The kernel invokes modprobe to load the\ncrypto module. This is a key indicator of CVE-2026-31431 (Copy Fail) exploitation,\nwhere the authencesn cipher is used to trigger a buffer overflow in the AF_ALG AEAD splice path,\ncorrupting the page cache of SUID binaries for local privilege escalation.\n\nOn Linux systems, modprobe is typically a symlink to kmod, so the process image will be /usr/bin/kmod (or /bin/kmod)\nwith 'modprobe' appearing in the command line.\n","references":["https://www.linkedin.com/posts/stamatis-chatzimangou_copyfail-kql-activity-7455582422215114752-S4RW/","https://www.splunk.com/en_us/blog/security/detecting-copy-fail-cve-2026-31431-phenomenal-power-itty-bitty-script.html","https://nvd.nist.gov/vuln/detail/CVE-2026-31431","https://man7.org/linux/man-pages/man8/modprobe.8.html","https://www.kernel.org/doc/html/latest/crypto/userspace-if.html"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.privilege-escalation","attack.t1068","attack.persistence","attack.t1547.006","detection.emerging-threats","cve.2026-31431"],"path":"rules-emerging-threats/2026/Exploits/CVE-2026-31431/proc_creation_lnx_exploit_cve_2026_31431_copyfail.yml","techniques":["T1068","T1547.006"],"cves":["CVE-2026-31431"]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}