mirror of
https://github.com/MBCProject/mbc-markdown
synced 2026-06-08 11:36:36 +00:00
ryan
2.1 KiB
2.1 KiB
| ID | F0010 |
| Objective(s) | Persistence, Privilege Escalation |
| Related ATT&CK Techniques | Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006) |
| Version | 2.2 |
| Created | 1 August 2019 |
| Last Modified | 5 December 2023 |
Kernel Modules and Extensions
Malware may use loadable kernel modules to persist on a system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. Malware may try to hide drivers or modules by creating them without a name.
See ATT&CK: Boot or Logon Autostart Execution: Kernel Modules and Extensions (T1547.006).
Methods
| Name | ID | Description |
|---|---|---|
| Device Driver | F0010.001 | Allows kernel to access hardware connected to the system. |
Use in Malware
| Name | Date | Method | Description |
|---|---|---|---|
| Drovorub | 2020 | -- | Drovorub uses a kernel module rootkit for loading and for persistence. [1] |
Detection
| Tool: CAPE | Mapping | APIs |
|---|---|---|
| volatility_devicetree_1 | Kernel Modules and Extensions (F0010) | -- |
| volatility_devicetree_1 | Kernel Modules and Extensions::Device Driver (F0010.001) | -- |
| driver_load | Kernel Modules and Extensions (F0010) | NtLoadDriver |
References
[1] https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF