THREATNOIR
Subscribe
MITRE ATT&CK · T1014

Rootkit

MITRE · cited in 12 of our lessons

Explanation

What attackers do. Attackers use rootkits to hide programs, files, network connections, drivers and other components from the operating system and security tools. Rootkits can operate in user mode, kernel mode or firmware, and they serve the Defence Evasion tactic.

How to defend. Enable secure boot and measured boot, enforce driver signing, and block known vulnerable drivers. Keep firmware updated and use endpoint tools with kernel-level visibility. When a rootkit is suspected, investigate from trusted media or memory captures rather than the live system.

Signs to look for. Look for discrepancies between what the system reports and what external sources see, such as network traffic from a host with no matching process, unexpected kernel drivers and integrity check failures. The main gap is trusting a compromised host to report on itself.

Open the technique on MITRE ATT&CK
The official text
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems. Rootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.