CAPECattack pattern

CAPEC-552 Install Rootkit

High Official page ↗

Abstraction: Detailed
Status: Draft
Likelihood of attack: Medium
Typical severity: High
CAPEC version: 3.9

Description

An adversary exploits a weakness in authentication to install malware that alters the functionality and information provide by targeted operating system API calls. Often referred to as rootkits, it is often used to hide the presence of programs, files, network connections, services, drivers, and other system components.

Mitigations

• Prevent adversary access to privileged accounts necessary to install rootkits.

Att&ck technique · MITRE ATT&CK (3)

T1547.006 Kernel Modules and Extensions sub-technique
T1542.003 Bootkit sub-technique
T1014 Rootkit technique

Child of · CAPEC (1)

CAPEC-542 Targeted Malware attack pattern

Weakness · CWE (1)

CWE-284 Improper Access Control weakness

Referenced by CWE · attack pattern (1)

CWE-284 Improper Access Control weakness