Robuta

https://attack.mitre.org/techniques/T1547/006/ Boot or Logon Autostart Execution: Kernel Modules and Extensions, Sub-technique T1547.006 -... kernel modules and extensionsbootlogonautostart