Kernel Modules and Extensions
Adversaries may modify the kernel to automatically execute programs on system boot. Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.(Citation: Linux Kernel Programming) When used maliciously, LKMs can be a type of kernel-mode [Root...
BY SOURCE
PROCEDURES (14)
Auto-extracted: 5 detections for kernel monitoring
Auto-extracted: 4 detections for bypass
Auto-extracted: 3 detections for unusual
Auto-extracted: 2 detections for evasion
Auto-extracted: 2 detections for driver
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for driver
Auto-extracted: 1 detections for service
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for suspicious