[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1014":3},{"item":4,"lessons":18,"controls":68,"related":96},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1014","T1014","Rootkit",12,"MITRE","**What attackers do.** Attackers use rootkits to hide programs, files, network connections, drivers and other components from the operating system and security tools. Rootkits can operate in user mode, kernel mode or firmware, and they serve the Defence Evasion tactic.\n\n**How to defend.** Enable secure boot and measured boot, enforce driver signing, and block known vulnerable drivers. Keep firmware updated and use endpoint tools with kernel-level visibility. When a rootkit is suspected, investigate from trusted media or memory captures rather than the live system.\n\n**Signs to look for.** Look for discrepancies between what the system reports and what external sources see, such as network traffic from a host with no matching process, unexpected kernel drivers and integrity check failures. The main gap is trusting a compromised host to report on itself.","Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting\u002Fhooking and modifying operating system API calls that supply system information.  \n\nRootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware.  Rootkits have been seen for Windows, Linux, and Mac OS X systems.  \n\nRootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1014\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"red-heron-exploits-unpatched-gitea-rce-to-hit-13-orgs-worldwide","Red Heron Exploits Unpatched Gitea RCE to Hit 13 Orgs Worldwide","2026-09-14T18:21:22.761+00:00",{"slug":25,"title":26,"published_at":27},"linux-rootkit-exploits-unpatched-f5-big-ip-apm-flaw-to-achieve-fileless-persistence","Linux Rootkit Exploits Unpatched F5 BIG-IP APM Flaw to Achieve Fileless Persistence","2026-09-08T22:22:35.275+00:00",{"slug":29,"title":30,"published_at":31},"ai-augmented-threat-actor-uat-10147-exploits-unpatched-web-servers-with-edr-bypassing-malware","AI-Augmented Threat Actor UAT-10147 Exploits Unpatched Web Servers with EDR-Bypassing Malware","2026-08-24T10:21:21.632+00:00",{"slug":33,"title":34,"published_at":35},"microsoft-defenders-btrsys-driver-abused-to-kill-security-tools-at-boot","Microsoft Defender's BTR.sys Driver Abused to Kill Security Tools at Boot","2026-08-21T18:20:48.853+00:00",{"slug":37,"title":38,"published_at":39},"honeymyte-apt-deploys-kernel-level-rootkit-to-evade-detection","HoneyMyte APT Deploys Kernel-Level Rootkit to Evade Detection","2026-08-14T10:21:26.174+00:00",{"slug":41,"title":42,"published_at":43},"microsoft-patch-tuesday-400-flaws-including-actively-exploited-zero-day-used-by-lazarus-group","Microsoft Patch Tuesday: 400 Flaws Including Actively Exploited Zero-Day Used by Lazarus Group","2026-08-11T20:21:40.408+00:00",{"slug":45,"title":46,"published_at":47},"cruciferra-crypter-bypasses-edr-using-byovd-and-process-ghosting-techniques","Cruciferra Crypter Bypasses EDR Using BYOVD and Process Ghosting Techniques","2026-07-27T12:21:14.473+00:00",{"slug":49,"title":50,"published_at":51},"13-year-undetected-intrusion-highlights-dangers-of-legacy-systems-and-poor-monitoring","13-Year Undetected Intrusion Highlights Dangers of Legacy Systems and Poor Monitoring","2026-07-16T15:21:00.411+00:00",{"slug":53,"title":54,"published_at":55},"goddamn-ransomware-exploits-signed-driver-to-kill-endpoint-defenses","GodDamn Ransomware Exploits Signed Driver to Kill Endpoint Defenses","2026-07-09T12:21:24.981+00:00",{"slug":57,"title":58,"published_at":59},"sprysocks-malware-abuses-kernel-drivers-to-evade-windows-security-tools","SprySOCKS Malware Abuses Kernel Drivers to Evade Windows Security Tools","2026-06-16T20:20:22.67+00:00",{"slug":61,"title":62,"published_at":63},"chinese-apt-deploys-stealthy-windows-rootkit-against-government-targets","Chinese APT Deploys Stealthy Windows Rootkit Against Government Targets","2026-06-16T19:22:18.735+00:00",{"slug":65,"title":66,"published_at":67},"sprysocks-backdoor-uses-kernel-drivers-to-hide-on-windows-systems","SprySOCKS Backdoor Uses Kernel Drivers to Hide on Windows Systems","2026-06-16T19:20:56.73+00:00",[69,73,78,83,87,91],{"slug":70,"name":71,"problem":72,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":74,"name":75,"problem":76,"stories":77},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",7,{"slug":79,"name":80,"problem":81,"stories":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":84,"name":85,"problem":86,"stories":82},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",{"slug":88,"name":89,"problem":90,"stories":82},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":92,"name":93,"problem":94,"stories":95},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",2,[97,103,108,113,118,122,126,130],{"family":98,"item":99,"code":100,"title":101,"together":102},"cis","10","Control 10","Malware Defenses",11,{"family":104,"item":105,"code":106,"title":107,"together":102},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":98,"item":109,"code":110,"title":111,"together":112},"13","Control 13","Network Monitoring and Defense",9,{"family":98,"item":114,"code":115,"title":116,"together":117},"2","Control 2","Inventory and Control of Software Assets",6,{"family":104,"item":119,"code":120,"title":121,"together":117},"cm-7","CM-7","Least Functionality",{"family":104,"item":123,"code":124,"title":125,"together":117},"au-12","AU-12","Audit Record Generation",{"family":104,"item":127,"code":128,"title":129,"together":117},"sc-7","SC-7","Boundary Protection",{"family":131,"item":132,"code":133,"title":134,"together":117},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring"]