T1547.006sub-technique of T1547 Boot or Logon Autostart Execution

Kernel Modules and Extensions

macOS · Linuxnothing on this site yetT1547.006 on attack.mitre.org

Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.
MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Suspicious execution on an endpoint

An EDR alert, an unexplained process, or a user reporting something odd.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detection Strategy for Kernel Modules and Extensions Autostart Execution

Monitor kernel module load/unload activity via modprobe, insmod, rmmod, or direct manipulation of /lib/modules. Correlate with installation of kernel headers, compilation commands, or downloads of.ko files. Detect anomalies in unsigned module loading or repeated module load attempts under non-root users.
Detect user-initiated kextload commands or modifications to /Library/Extensions. Correlate with changes to KextPolicy database or unauthorized developer signing identities. Alert on attempts to disable SIP or load legacy extensions from unsigned sources.

what reduces it

M1038 Execution Prevention. Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.
M1018 User Account Management. Use MDM to disable user's ability to install or approve kernel extensions, and ensure all approved kernel extensions are in alignment with policies specified in `com.apple.syspolicy.kernel-extension-policy`.
M1026 Privileged Account Management. Limit access to the root account and prevent users from loading kernel modules and extensions through proper privilege separation and limiting Privilege Escalation opportunities.
M1049 Antivirus/Antimalware. Common tools for detecting Linux rootkits include: rkhunter, chrootkit, although rootkits may be designed to evade certain detection tools.

the rest of T1547

T1547.001 Registry Run Keys / Startup Folder · 8 on this site
T1547.002 Authentication Package · not covered yet
T1547.003 Time Providers · not covered yet
T1547.004 Winlogon Helper DLL · not covered yet
T1547.005 Security Support Provider · not covered yet
T1547.007 Re-opened Applications · not covered yet
T1547.008 LSASS Driver · not covered yet
T1547.009 Shortcut Modification · not covered yet
T1547.010 Port Monitors · not covered yet
T1547.012 Print Processors · not covered yet
T1547.013 XDG Autostart Entries · not covered yet
T1547.014 Active Setup · not covered yet
T1547.015 Login Items · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.