LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1215: Kernel Modules and Extensions

Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. [1] When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode Rootkit that run with the highest operating system privilege (Ring 0). [2] Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. [3] [4] [5] [6]

Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. [7]

Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands. Several examples have been found where this can be used. [8] [9] Examples have been found in the wild. [10]

EnterpriseT1215TechniqueObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Historical object

This ATT&CK object is revoked or deprecated in the current MITRE ATT&CK release.

It remains available for historical context and inbound links. Use current ATT&CK relationships and replacement guidance before basing detection or reporting work on this page.

Glexia's Take · Automated analysis

Automated summary not available

Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.

Official MITRE ATT&CK definition

Kernel Modules and Extensions

Loadable Kernel Modules (or LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand. They extend the functionality of the kernel without the need to reboot the system. For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system. [1] When used maliciously, Loadable Kernel Modules (LKMs) can be a type of kernel-mode Rootkit that run with the highest operating system privilege (Ring 0). [2] Adversaries can use loadable kernel modules to covertly persist on a system and evade defenses. Examples have been found in the wild and there are some open source projects. [3] [4] [5] [6]

Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors and enabling root access to non-privileged users. [7]

Kernel extensions, also called kext, are used for macOS to load functionality onto a system similar to LKMs for Linux. They are loaded and unloaded through kextload and kextunload commands. Several examples have been found where this can be used. [8] [9] Examples have been found in the wild. [10]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
DomainIDNameRelationship / procedure
EnterpriseT1547.006Kernel Modules and ExtensionsSub-techniqueThis object revoked by Kernel Modules and Extensions.
Relationship explorer

All related ATT&CK context

revoked by · TechniqueT1547.006: Kernel Modules and ExtensionsEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
935412bcab6ae536...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundleRevoked935412bcab6a…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Linux Kernel Programming

    Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018.

    Open source URL
  2. [2]
    Linux Kernel Module Programming Guide

    Pomerantz, O., Salzman, P. (2003, April 4). Modules vs Programs. Retrieved April 6, 2018.

  3. [3]
    Volatility Phalanx2

    Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018.

    Open source URL
  4. [4]
    CrowdStrike Linux Rootkit

    Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017.

    Open source URL
  5. [5]
    GitHub Reptile

    Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved April 9, 2018.

    Open source URL
  6. [6]
    GitHub Diamorphine

    Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018.

    Open source URL
  7. [7]
    iDefense Rootkit Overview

    Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved April 6, 2018.

  8. [8]
    RSAC 2015 San Francisco Patrick Wardle

    Wardle, P. (2015, April). Malware Persistence on OS X Yosemite. Retrieved April 6, 2018.

    Open source URL
  9. [9]
    Synack Secure Kernel Extension Broken

    Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel Extension Loading’ is Broken. Retrieved April 6, 2018.

    Open source URL
  10. [10]
    Securelist Ventir

    Mikhail, K. (2014, October 16). The Ventir Trojan: assemble your MacOS spy. Retrieved April 6, 2018.

    Open source URL
  11. [11]
    CrowdStrike Linux Rootkit

    Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017.

    Open source URL
  12. [12]
    CrowdStrike Linux Rootkit

    Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017.

    Open source URL
  13. [13]
    GitHub Diamorphine

    Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018.

    Open source URL
  14. [14]
    GitHub Diamorphine

    Mello, V. (2018, March 8). Diamorphine - LMK rootkit for Linux Kernels 2.6.x/3.x/4.x (x86 and x86_64). Retrieved April 9, 2018.

    Open source URL
  15. [15]
    GitHub Reptile

    Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved April 9, 2018.

    Open source URL
  16. [16]
    GitHub Reptile

    Augusto, I. (2018, March 8). Reptile - LMK Linux rootkit. Retrieved April 9, 2018.

    Open source URL
  17. [17]
    Linux Kernel Module Programming Guide

    Pomerantz, O., Salzman, P. (2003, April 4). Modules vs Programs. Retrieved April 6, 2018.

  18. [18]
    Linux Kernel Module Programming Guide

    Pomerantz, O., Salzman, P. (2003, April 4). Modules vs Programs. Retrieved April 6, 2018.

  19. [19]
    Linux Kernel Programming

    Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018.

    Open source URL
  20. [20]
    Linux Kernel Programming

    Pomerantz, O., Salzman, P.. (2003, April 4). The Linux Kernel Module Programming Guide. Retrieved April 6, 2018.

    Open source URL
  21. [21]
    Linux Loadable Kernel Module Insert and Remove LKMs

    Henderson, B. (2006, September 24). How To Insert And Remove LKMs. Retrieved April 9, 2018.

  22. [22]
    Linux Loadable Kernel Module Insert and Remove LKMs

    Henderson, B. (2006, September 24). How To Insert And Remove LKMs. Retrieved April 9, 2018.

  23. [23]
    Linux Loadable Kernel Module Insert and Remove LKMs

    Henderson, B. (2006, September 24). How To Insert And Remove LKMs. Retrieved April 9, 2018.

  24. [24]
    RSAC 2015 San Francisco Patrick Wardle

    Wardle, P. (2015, April). Malware Persistence on OS X Yosemite. Retrieved April 6, 2018.

    Open source URL
  25. [25]
    RSAC 2015 San Francisco Patrick Wardle

    Wardle, P. (2015, April). Malware Persistence on OS X Yosemite. Retrieved April 6, 2018.

    Open source URL
  26. [26]
    Securelist Ventir

    Mikhail, K. (2014, October 16). The Ventir Trojan: assemble your MacOS spy. Retrieved April 6, 2018.

    Open source URL
  27. [27]
    Securelist Ventir

    Mikhail, K. (2014, October 16). The Ventir Trojan: assemble your MacOS spy. Retrieved April 6, 2018.

    Open source URL
  28. [28]
    Synack Secure Kernel Extension Broken

    Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel Extension Loading’ is Broken. Retrieved April 6, 2018.

    Open source URL
  29. [29]
    Synack Secure Kernel Extension Broken

    Wardle, P. (2017, September 8). High Sierra’s ‘Secure Kernel Extension Loading’ is Broken. Retrieved April 6, 2018.

    Open source URL
  30. [30]
    Volatility Phalanx2

    Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018.

    Open source URL
  31. [31]
    Volatility Phalanx2

    Case, A. (2012, October 10). Phalanx 2 Revealed: Using Volatility to Analyze an Advanced Linux Rootkit. Retrieved April 9, 2018.

    Open source URL
  32. [32]
    Wikipedia Loadable Kernel Module

    Wikipedia. (2018, March 17). Loadable kernel module. Retrieved April 9, 2018.

    Open source URL
  33. [33]
    Wikipedia Loadable Kernel Module

    Wikipedia. (2018, March 17). Loadable kernel module. Retrieved April 9, 2018.

    Open source URL
  34. [34]
    Wikipedia Loadable Kernel Module

    Wikipedia. (2018, March 17). Loadable kernel module. Retrieved April 9, 2018.

    Open source URL
  35. [35]
    iDefense Rootkit Overview

    Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved April 6, 2018.

  36. [36]
    iDefense Rootkit Overview

    Chuvakin, A. (2003, February). An Overview of Rootkits. Retrieved April 6, 2018.

  37. [37]
    mitre-attackT1215
    Open source URL
  38. [38]
    mitre-attackT1215
    Open source URL
  39. [39]
    mitre-attackT1215
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use