CmdID / Techniques / T1547

T1547.006 Boot or Logon Autostart Execution: Kernel Modules and Extensions

Adversaries may modify the kernel to automatically execute programs on system boot. MITRE ATT&CK

1 Sigma rule T1547.006 on attack.mitre.org