An object file that contains code to extend the running kernel of an OS, typically used to add support for new hardware (as device drivers) and/or filesystems, or for adding system calls
An object file that contains code to extend the running kernel of an OS, typically used to add support for new hardware (as device drivers) and/or filesystems, or for adding system calls
| Domain | ID | Name | Detects | |
|---|---|---|---|---|
| Enterprise | T1547 | 启动或登录自动启动执行 |
Monitor for unusual kernel driver installation activity that may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems. |
|
| .006 | Kernel Modules and Extensions |
LKMs are typically loaded into |
||
| Enterprise | T1611 | 逃逸至主机 |
Monitor for the installation of kernel modules that could be abused to escape containers on a host. |
|