MITRE ATT&CKtechnique

T1014 Rootkit

Published 2017-05-31 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
2.0
Created
2017-05-31

Description

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems. Rootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (33)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • C0056 RedPenguin campaign
  • S1219 REPTILE software (malware)
  • S1220 MEDUSA software (malware)
  • G1048 UNC3886 group
  • C0046 ArcaneDoor campaign
  • S1186 Line Dancer software (malware)
  • S1105 COATHANGER software (malware)
  • S0670 WarzoneRAT software (malware)
  • G0139 TeamTNT group
  • S0601 Hildegard software (malware)
  • S0572 Caterpillar WebShell software (malware)
  • S0603 Stuxnet software (malware)
  • S0502 Drovorub software (malware)
  • S0484 Carberp software (malware)
  • S0468 Skidmap software (malware)
  • S0458 Ramsay software (malware)
  • G0106 Rocke group
  • S0430 Winnti for Linux software (malware)
  • G0096 APT41 group
  • S0397 LoJax software (malware)
  • S0394 HiddenWasp software (malware)
  • S0377 Ebury software (malware)
  • S0221 Umbreon software (malware)
  • G0007 APT28 group
  • G0044 Winnti Group group
  • S0009 Hikit software (malware)
  • S0012 PoisonIvy software (malware)
  • S0022 Uroburos software (malware)
  • S0027 Zeroaccess software (malware)
Show all 33 ›

Referenced by CAPEC · att&ck technique (1)

References