LKM for Linux. Drivers are one type of kernel extentions.
kext for macOS.
kextunload. These need to be signed with a cert approved by Apple. Otherwise, to launch the app one needs to disable SIP. That’s probably the reason why the RAM cannot be dumped on macOS with SIP enabled. Replaced by System Extentions but still can be used.
Remember the “Reopen windows when logging back in” prompt on macOS? When selected, all applications currently open are added to a property list file named
com.apple.loginwindow.[UUID].plist within the
~/Library/Preferences/ByHost directory. Applications listed in this file are automatically reopened upon the user’s next logon.
Abuse shortcuts in the startup folder to execute their tools and achieve persistence
spoolsv.exeruns under SYSTEM privileges.
- Local Port
- Standard TCP/IP Port
- USB Monitor
- WSD Port
Print processors are DLLs that are loaded by the print spooler service, spoolsv.exe (SYSTEM permissions, during boot.
AddPrintProcessorfor account with
- adding the
HKLM\SYSTEM\[CurrentControlSet or ControlSet001]\Control\Print\Environments\[Windows architecture: e.g., Windows x64]\Print Processors\[user defined]\DriverRegistry key that points to the DLL.
- Wardle, Patrick. The Art of Mac Malware
- PEASS, detect possible PE vectors on a W/L/M machine.
- GTFOBins, https://gtfobins.github.io/