{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1014","id":"T1014","name":"Rootkit","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1014","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"75af7b415c00e6ceca158500d3d4b68ee43d03a4ca9489f972e0cacdec928420","description":"Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) \n\nRootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit)\n\nRootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1014","external_id":"T1014"},{"source_name":"CrowdStrike Linux Rootkit","description":"Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017.","url":"https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/"},{"source_name":"BlackHat Mac OSX Rootkit","description":"Pan, M., Tsai, S. (2014). You can’t see me: A Mac OS X Rootkit uses the tricks you haven't known yet. Retrieved December 21, 2017.","url":"http://www.blackhat.com/docs/asia-14/materials/Tsai/WP-Asia-14-Tsai-You-Cant-See-Me-A-Mac-OS-X-Rootkit-Uses-The-Tricks-You-Havent-Known-Yet.pdf"},{"source_name":"Symantec Windows Rootkits","description":"Symantec. (n.d.). Windows Rootkit Overview. Retrieved December 21, 2017.","url":"https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf"},{"source_name":"Wikipedia Rootkit","description":"Wikipedia. (2016, June 1). Rootkit. Retrieved June 2, 2016.","url":"https://en.wikipedia.org/wiki/Rootkit"}],"platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0079","name":"Driver Load","page":"telemetry/DC0079/","kind":"attack_component","category":"Endpoint activity","description":"Loading of a driver into the running OS.","collection_focus":"Collect Sysmon DriverLoad (6) and retain image path, hash and signature result; distinguish load from file installation.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["driver_path","action","signature_status"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0079","collector":"illustrative-lab-collector","observation":{"driver_path":"C:\\Lab\\demo.sys","action":"load","signature_status":"lab_fixture_only"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0060","name":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component","category":"Windows and directory audit","description":"Installation or registration of a service.","collection_focus":"Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["service","action","executable","actor"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1014","id":"T1014","name":"Rootkit","domain":"enterprise","platforms":["Linux","macOS","Windows"],"environments":["cloud-hosted-endpoint","onprem"],"source_url":"https://attack.mitre.org/techniques/T1014","technique_page":"techniques/enterprise/T1014/","page":"detections/enterprise/T1014/","status":"rule_source_available","counts":{"sigma":1,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":3,"live_validated":0},"sigma_rules":[{"id":"22236d75-d5a0-4287-bf06-c93b1770860f","title":"Triple Cross eBPF Rootkit Install Commands","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/22236d75-d5a0-4287-bf06-c93b1770860f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_triple_cross_rootkit_install.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"}],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0377","name":"Detection of Kernel/User-Level Rootkit Behavior Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0377","stix_id":"x-mitre-detection-strategy--00a4e92b-8164-4342-a71c-013ecc777ad0","relationship_id":"relationship--13f0f64f-c275-48dc-8fb3-dda48df60d8c","description":"","analytics":[{"id":"AN1061","name":"Analytic 1061","guidance":"Unauthorized or anomalous loading of kernel-mode drivers or DLLs, concealed services, or abnormal modification of boot components indicative of rootkit activity.","url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1061","platforms":["Windows"],"tuning":[{"field":"DriverSignatureStatus","description":"Signed vs unsigned drivers; many environments restrict unsigned drivers, but some legacy systems allow them."},{"field":"TargetDirectory","description":"Suspicious driver or DLL drop locations, e.g., \\System32\\Drivers\\ or \\Temp\\"},{"field":"UserContext","description":"Rootkit installation via admin or SYSTEM account."}],"log_sources":[{"component_id":"DC0079","component":"Driver Load","name":"WinEventLog:Sysmon","channel":"EventCode=6","platforms":["Windows"],"analytic_id":"AN1061","source_url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1061","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0079/"},{"component_id":"DC0060","component":"Service Creation","name":"WinEventLog:System","channel":"EventCode=7045","platforms":["Windows"],"analytic_id":"AN1061","source_url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1061","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0060/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1061","source_url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1061","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]},{"id":"AN1062","name":"Analytic 1062","guidance":"Abnormal loading of kernel modules, direct tampering with /dev, /proc, or LD_PRELOAD behaviors hiding processes or files.","url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1062","platforms":["Linux"],"tuning":[{"field":"MonitoredDirectories","description":"Directories where kernel modules or tampering could be staged (e.g., /lib/modules/)."},{"field":"ModuleNamePattern","description":"Regex or heuristic match to anomalous module names (e.g., suspicious entropy or gibberish)."},{"field":"LD_PRELOAD","description":"Monitor presence of suspicious preload values that mask processes or files."}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:EXECVE","channel":"None","platforms":["Linux"],"analytic_id":"AN1062","source_url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1062","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0061","component":"File Modification","name":"linux:osquery","channel":"file_events","platforms":["Linux"],"analytic_id":"AN1062","source_url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1062","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"},{"component_id":"DC0016","component":"Module Load","name":"linux:syslog","channel":"kmod","platforms":["Linux"],"analytic_id":"AN1062","source_url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1062","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN1063","name":"Analytic 1063","guidance":"Execution of unsigned kernel extensions (KEXTs), tampering with LaunchDaemons, or userspace hooks into system libraries.","url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1063","platforms":["macOS"],"tuning":[{"field":"KextSignatureStatus","description":"Allowable level of unsigned/3rd-party kernel extensions varies by organization."},{"field":"KextLoadOrigin","description":"Detect whether the extension was loaded by an untrusted process or non-root user."},{"field":"AnomalousLaunchAgent","description":"Detection tuned based on deviation from known/approved LaunchDaemon plist files."}],"log_sources":[{"component_id":"DC0016","component":"Module Load","name":"macos:unifiedlog","channel":"subsystem=com.apple.kextd","platforms":["macOS"],"analytic_id":"AN1063","source_url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1063","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"},{"component_id":"DC0060","component":"Service Creation","name":"macos:osquery","channel":"launch_daemons","platforms":["macOS"],"analytic_id":"AN1063","source_url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1063","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0060/"},{"component_id":"DC0061","component":"File Modification","name":"fs:fsevents","channel":"Extensions","platforms":["macOS"],"analytic_id":"AN1063","source_url":"https://attack.mitre.org/detectionstrategies/DET0377#AN1063","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]}]}],"telemetry_references":[{"id":"DC0079","name":"Driver Load","tag":"Driver Load","page":"telemetry/DC0079/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0060","name":"Service Creation","tag":"Service Creation","page":"telemetry/DC0060/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0040","name":"HTRAN","page":"tools/S0040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0040","name":"HTRAN","page":"tools/S0040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0009","name":"Hikit","url":"https://attack.mitre.org/software/S0009","kind":"malware","description":"[Hikit](https://attack.mitre.org/software/S0009) is a [Rootkit](https://attack.mitre.org/techniques/T1014) that has been used by [Axiom](https://attack.mitre.org/groups/G0001).(Citation: FireEye Hikit Rootkit) (Citation: FireEye HIKIT Rootkit Part 2) ","relationship_id":"relationship--aacb43b8-2d3a-40bc-9f7b-1acb5b2474f2","references":[{"source_name":"FireEye Hikit Rootkit","description":"Glyer, C., Kazanciyan, R. (2012, August 20). The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 1). Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190216180458/https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-1.html"},{"source_name":"FireEye HIKIT Rootkit Part 2","description":"Glyer, C., Kazanciyan, R. (2012, August 22). The “Hikit” Rootkit: Advanced and Persistent Attack Techniques (Part 2). Retrieved November 17, 2024.","url":"https://web.archive.org/web/20210920172620/https://www.fireeye.com/blog/threat-research/2012/08/hikit-rootkit-advanced-persistent-attack-techniques-part-2.html"}]},{"id":"S0012","name":"PoisonIvy","url":"https://attack.mitre.org/software/S0012","kind":"malware","description":"[PoisonIvy](https://attack.mitre.org/software/S0012) starts a rootkit from a malicious file dropped to disk.(Citation: Symantec Darkmoon Aug 2005)","relationship_id":"relationship--f8340d49-ee7a-4ade-988f-3660904a18bb","references":[{"source_name":"Symantec Darkmoon Aug 2005","description":"Hayashi, K. (2005, August 18). Backdoor.Darkmoon. Retrieved February 23, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2005-081910-3934-99"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.(Citation: Kaspersky Turla)(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--eb74fa31-121d-4e43-9794-048a901f509a","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"},{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"id":"S0027","name":"Zeroaccess","url":"https://attack.mitre.org/software/S0027","kind":"malware","description":"[Zeroaccess](https://attack.mitre.org/software/S0027) is a kernel-mode rootkit.(Citation: Sophos ZeroAccess)","relationship_id":"relationship--da6aa745-9eb5-44d9-80f8-e9f542d106d2","references":[{"source_name":"Sophos ZeroAccess","description":"Wyke, J. (2012, April). ZeroAccess. Retrieved July 18, 2016.","url":"https://sophosnews.files.wordpress.com/2012/04/zeroaccess2.pdf"}]},{"id":"S0040","name":"HTRAN","url":"https://attack.mitre.org/software/S0040","kind":"tool","description":"[HTRAN](https://attack.mitre.org/software/S0040) can install a rootkit to hide network connections from the host OS.(Citation: NCSC Joint Report Public Tools)","relationship_id":"relationship--4b14d96b-1664-4072-a49a-3a990a13ca83","references":[{"source_name":"NCSC Joint Report Public Tools","description":"The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.","url":"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"}]},{"id":"S0047","name":"Hacking Team UEFI Rootkit","url":"https://attack.mitre.org/software/S0047","kind":"malware","description":"[Hacking Team UEFI Rootkit](https://attack.mitre.org/software/S0047) is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.(Citation: TrendMicro Hacking Team UEFI)","relationship_id":"relationship--89433640-bf49-48b3-9f26-76423cd36f77","references":[{"source_name":"TrendMicro Hacking Team UEFI","description":"Lin, P. (2015, July 13). Hacking Team Uses UEFI BIOS Rootkit to Keep RCS 9 Agent in Target Systems. Retrieved December 11, 2015.","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/hacking-team-uses-uefi-bios-rootkit-to-keep-rcs-9-agent-in-target-systems/"}]},{"id":"S0135","name":"HIDEDRV","url":"https://attack.mitre.org/software/S0135","kind":"malware","description":"[HIDEDRV](https://attack.mitre.org/software/S0135) is a rootkit that hides certain operating system artifacts.(Citation: ESET Sednit Part 3)","relationship_id":"relationship--69b9edd8-c1a8-4cbd-bd94-9af0fdefe013","references":[{"source_name":"ESET Sednit Part 3","description":"ESET. (2016, October). En Route with Sednit - Part 3: A Mysterious Downloader. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part3.pdf"}]},{"id":"S0221","name":"Umbreon","url":"https://attack.mitre.org/software/S0221","kind":"malware","description":"[Umbreon](https://attack.mitre.org/software/S0221) hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.(Citation: Umbreon Trend Micro)","relationship_id":"relationship--7653431a-18ac-43da-8308-63c76ecf0c22","references":[{"source_name":"Umbreon Trend Micro","description":"Fernando Mercês. (2016, September 5). Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems. Retrieved March 5, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/?_ga=2.180041126.367598458.1505420282-1759340220.1502477046"}]},{"id":"S0377","name":"Ebury","url":"https://attack.mitre.org/software/S0377","kind":"malware","description":"[Ebury](https://attack.mitre.org/software/S0377) acts as a user land rootkit using the SSH service.(Citation: ESET Ebury Oct 2017)(Citation: ESET Ebury May 2024)","relationship_id":"relationship--05a3d203-4b38-4f38-a015-dcfe3bdf9c07","references":[{"source_name":"ESET Ebury May 2024","description":"Marc-Etienne M.Léveillé. (2024, May 1). Ebury is alive but unseen. Retrieved May 21, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/ebury-is-alive-but-unseen.pdf"},{"source_name":"ESET Ebury Oct 2017","description":"Vachon, F. (2017, October 30). Windigo Still not Windigone: An Ebury Update . Retrieved February 10, 2021.","url":"https://www.welivesecurity.com/2017/10/30/windigo-ebury-update-2/"}]},{"id":"S0394","name":"HiddenWasp","url":"https://attack.mitre.org/software/S0394","kind":"malware","description":"[HiddenWasp](https://attack.mitre.org/software/S0394) uses a rootkit to hook and implement functions on the system.(Citation: Intezer HiddenWasp Map 2019)","relationship_id":"relationship--8a8e30e6-c226-4739-87de-bd98c104d211","references":[{"source_name":"Intezer HiddenWasp Map 2019","description":"Sanmillan, I. (2019, May 29). HiddenWasp Malware Stings Targeted Linux Systems. Retrieved June 24, 2019.","url":"https://www.intezer.com/blog-hiddenwasp-malware-targeting-linux-systems/"}]},{"id":"S0397","name":"LoJax","url":"https://attack.mitre.org/software/S0397","kind":"malware","description":"[LoJax](https://attack.mitre.org/software/S0397) is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.(Citation: ESET LoJax Sept 2018)","relationship_id":"relationship--e9f52758-d5aa-4a16-b614-ea756a0cf270","references":[{"source_name":"ESET LoJax Sept 2018","description":"ESET. (2018, September). LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group. Retrieved July 2, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf"}]},{"id":"S0430","name":"Winnti for Linux","url":"https://attack.mitre.org/software/S0430","kind":"malware","description":"[Winnti for Linux](https://attack.mitre.org/software/S0430) has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.(Citation: Chronicle Winnti for Linux May 2019)","relationship_id":"relationship--c85d86c0-8adc-42fc-b7c9-8ca33d9ac4b6","references":[{"source_name":"Chronicle Winnti for Linux May 2019","description":"Chronicle Blog. (2019, May 15). Winnti: More than just Windows and Gates. Retrieved April 29, 2020.","url":"https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) has included a rootkit to evade defenses.(Citation: Eset Ramsay May 2020)\t","relationship_id":"relationship--2962304a-f96e-4323-958f-f685eae97ac6","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"}]},{"id":"S0468","name":"Skidmap","url":"https://attack.mitre.org/software/S0468","kind":"malware","description":"[Skidmap](https://attack.mitre.org/software/S0468) is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.(Citation: Trend Micro Skidmap)","relationship_id":"relationship--759185fe-d576-43f5-afac-acd653e5fcf4","references":[{"source_name":"Trend Micro Skidmap","description":"Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"}]},{"id":"S0484","name":"Carberp","url":"https://attack.mitre.org/software/S0484","kind":"malware","description":"[Carberp](https://attack.mitre.org/software/S0484) has used user mode rootkit techniques to remain hidden on the system.(Citation: Prevx Carberp March 2011)","relationship_id":"relationship--21b929b8-8fec-47a5-8f98-554a043f9de5","references":[{"source_name":"Prevx Carberp March 2011","description":"Giuliani, M., Allievi, A. (2011, February 28). Carberp - a modular information stealing trojan. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20231227000328/http://pxnow.prevx.com/content/blog/carberp-a_modular_information_stealing_trojan.pdf"}]},{"id":"S0502","name":"Drovorub","url":"https://attack.mitre.org/software/S0502","kind":"malware","description":"[Drovorub](https://attack.mitre.org/software/S0502) has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.(Citation: NSA/FBI Drovorub August 2020)","relationship_id":"relationship--3da780a6-2bd0-47ce-b434-fe513abb7ee5","references":[{"source_name":"NSA/FBI Drovorub August 2020","description":"NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020.","url":"https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF"}]},{"id":"S0572","name":"Caterpillar WebShell","url":"https://attack.mitre.org/software/S0572","kind":"malware","description":"[Caterpillar WebShell](https://attack.mitre.org/software/S0572) has a module to use a rootkit on a system.(Citation: ClearSky Lebanese Cedar Jan 2021) ","relationship_id":"relationship--f16c71ae-99b1-4aff-b276-13eb7c3ad889","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) has modified /etc/ld.so.preload to overwrite readdir() and readdir64().(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--8f5fdbbc-73b1-48a6-9916-67c0baa0f66e","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) uses a Windows rootkit to mask its binaries and other relevant files.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--7c85cd06-5b92-4b5d-acf5-fdd12a73b289","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can include a rootkit to hide processes, files, and startup.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--eeb368b7-52b9-4320-a34f-8f3235beb22f","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S1105","name":"COATHANGER","url":"https://attack.mitre.org/software/S1105","kind":"malware","description":"[COATHANGER](https://attack.mitre.org/software/S1105) hooks or replaces multiple legitimate processes and other functions on victim devices.(Citation: NCSC-NL COATHANGER Feb 2024)","relationship_id":"relationship--8162c91d-b82d-4e19-9fac-5a7191e4aa17","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","description":"Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}]},{"id":"S1186","name":"Line Dancer","url":"https://attack.mitre.org/software/S1186","kind":"malware","description":"[Line Dancer](https://attack.mitre.org/software/S1186) can hook both the crash dump process and the Autehntication, Authorization, and Accounting (AAA) functions on compromised machines to evade forensic analysis and authentication mechanisms.(Citation: Cisco ArcaneDoor 2024)","relationship_id":"relationship--95283b95-4474-47ac-9e77-a1f4da968f9f","references":[{"source_name":"Cisco ArcaneDoor 2024","description":"Cisco Talos. (2024, April 24). ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices. Retrieved January 6, 2025.","url":"https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/"}]},{"id":"S1219","name":"REPTILE","url":"https://attack.mitre.org/software/S1219","kind":"malware","description":"[REPTILE](https://attack.mitre.org/software/S1219) has the ability to hook kernel functions and modify functions data to achieve rootkit functionality such as hiding processes and network connections.(Citation: Google Cloud Mandiant UNC3886 2024)","relationship_id":"relationship--af3233ba-82e8-49d1-bce7-2b96aced774d","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"id":"S1220","name":"MEDUSA","url":"https://attack.mitre.org/software/S1220","kind":"malware","description":"[MEDUSA](https://attack.mitre.org/software/S1220) is a rootkit with command execution and credential logging capabilities.(Citation: Google Cloud Mandiant UNC3886 2024)\n","relationship_id":"relationship--add8d076-83a4-44cf-8e4c-90caa144e488","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]}],"actors":[{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has used a UEFI (Unified Extensible Firmware Interface) rootkit known as [LoJax](https://attack.mitre.org/software/S0397).(Citation: Symantec APT28 Oct 2018)(Citation: ESET LoJax Sept 2018)","relationship_id":"relationship--a5022441-bc5e-4b19-a773-b96b2719d1bb","references":[{"source_name":"Symantec APT28 Oct 2018","description":"Symantec Security Response. (2018, October 04). APT28: New Espionage Operations Target Military and Government Organizations. Retrieved November 14, 2018.","url":"https://www.symantec.com/blogs/election-security/apt28-espionage-military-government"},{"source_name":"ESET LoJax Sept 2018","description":"ESET. (2018, September). LOJAX First UEFI rootkit found in the wild, courtesy of the Sednit group. Retrieved July 2, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf"}]},{"id":"G0044","name":"Winnti Group","url":"https://attack.mitre.org/groups/G0044","kind":"intrusion-set","description":"[Winnti Group](https://attack.mitre.org/groups/G0044) used a rootkit to modify typical server functionality.(Citation: Kaspersky Winnti April 2013)","relationship_id":"relationship--05e05236-1635-48d7-8ee3-33319c01c815","references":[{"source_name":"Kaspersky Winnti April 2013","description":"Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) deployed rootkits on Linux systems.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)","relationship_id":"relationship--1be07717-ad08-4364-9a58-b44a95a389a5","references":[{"source_name":"Crowdstrike GTR2020 Mar 2020","description":"Crowdstrike. (2020, March 2). 2020 Global Threat Report. Retrieved December 11, 2020.","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source_name":"FireEye APT41 Aug 2019","description":"Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"id":"G0106","name":"Rocke","url":"https://attack.mitre.org/groups/G0106","kind":"intrusion-set","description":"[Rocke](https://attack.mitre.org/groups/G0106) has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.(Citation: Anomali Rocke March 2019)","relationship_id":"relationship--2107aab0-0191-46d1-abec-8d98ac916c21","references":[{"source_name":"Anomali Rocke March 2019","description":"Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.(Citation: Trend Micro TeamTNT) (Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--6b8a8055-5b1c-4e06-a6ef-4a42e23e2e11","references":[{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source_name":"Trend Micro TeamTNT","description":"Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":"[UNC3886](https://attack.mitre.org/groups/G1048) has used the publicly available rootkits [REPTILE](https://attack.mitre.org/software/S1219) and [MEDUSA](https://attack.mitre.org/software/S1220) on targeted VMs.(Citation: Google Cloud Mandiant UNC3886 2024)","relationship_id":"relationship--b3c11e91-229d-4624-bf0c-2178c780c5cd","references":[{"source_name":"Google Cloud Mandiant UNC3886 2024","description":" Punsaen Boonyakarn, Shawn Chew, Logeswaran Nadarajan, Mathew Potaczek, Jakub Jozwiak, and Alex Marvi. (2024, June 18). Cloaked and Covert: Uncovering UNC3886 Espionage Operations. Retrieved September 24, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]}],"mitigations":[],"candidates":[{"id":"0b996469-48c6-46e2-8155-a17f8b6c2247","name":"Loadable Kernel Module based Rootkit (Diamorphine)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1014/T1014.yaml","description":"Loads Diamorphine kernel module, which hides itself and a processes.\n","inputs":{"repo":{"description":"Url of the diamorphine github repo","type":"string","default":"https://github.com/m0nad/Diamorphine/"},"rev":{"description":"Revision of the github repo zip","type":"string","default":"898810523aa2033f582a4a5903ffe453334044f9"},"rootkit_name":{"description":"Module name","type":"string","default":"diamorphine"}},"dependencies":[{"description":"The kernel module must exist on disk at specified location (#{rootkit_name}.ko)\n"}],"source_definition_sha256":"cdba1f0da01599a21affd79d9dcd79fb4e1641c712072d285020685c0fa278a9"},{"id":"1338bf0c-fd0c-48c0-9e65-329f18e2c0d3","name":"dynamic-linker based rootkit (libprocesshider)","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1014/T1014.yaml","description":"Uses libprocesshider to simulate rootkit behavior by hiding a specific process name via ld.so.preload (see also T1574.006).\n","inputs":{"repo":{"description":"Url of the github repo zip","type":"string","default":"https://github.com/gianlucaborello/libprocesshider/"},"rev":{"description":"Revision of the github repo zip","type":"string","default":"25e0587d6bf2137f8792dc83242b6b0e5a72b415"},"library_path":{"description":"Full path of the library to add to ld.so.preload","type":"string","default":"/usr/local/lib/libprocesshider.so"}},"dependencies":[{"description":"The preload library must exist on disk at specified location (#{library_path})\n"}],"source_definition_sha256":"1dadab8b7a92249cbb7390c7e9c401c36ad191c51539b30127d86edf584be413"},{"id":"75483ef8-f10f-444a-bf02-62eb0e48db6f","name":"Loadable Kernel Module based Rootkit","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1014/T1014.yaml","description":"Loadable Kernel Module based Rootkit\n","inputs":{"rootkit_source_path":{"description":"Path to the rootkit source. Used when prerequisites are fetched.","type":"path","default":"PathToAtomicsFolder/T1014/src/Linux"},"rootkit_name":{"description":"Module name","type":"string","default":"T1014"}},"dependencies":[{"description":"The kernel module must exist on disk at specified location (#{rootkit_source_path}/#{rootkit_name}.ko)\n"}],"source_definition_sha256":"c138df3b17df653c8ed4a52b5ba68d09f17795617304987f5f28f7e5e8c321f4"},{"id":"dfb50072-e45a-4c75-a17e-a484809c8553","name":"Loadable Kernel Module based Rootkit","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1014/T1014.yaml","description":"Loadable Kernel Module based Rootkit\n","inputs":{"rootkit_source_path":{"description":"Path to the rootkit source. Used when prerequisites are fetched.","type":"path","default":"PathToAtomicsFolder/T1014/src/Linux"},"rootkit_path":{"description":"Path To rootkit","type":"string","default":"PathToAtomicsFolder/T1014/bin"},"rootkit_name":{"description":"Module name","type":"string","default":"T1014"}},"dependencies":[{"description":"The kernel module must exist on disk at specified location (#{rootkit_path}/#{rootkit_name}.ko)\n"}],"source_definition_sha256":"bc969aef28478f8bf0f53c0f2544d275990bd99d64e3749cc542f2923660bd3e"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1542.001":"/ttp-simulation/techniques/enterprise/T1542.001/","T1542.003":"/ttp-simulation/techniques/enterprise/T1542.003/","T1014":"/ttp-simulation/techniques/enterprise/T1014/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1014","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0079","collector":"illustrative-lab-collector","observation":{"driver_path":"C:\\Lab\\demo.sys","action":"load","signature_status":"lab_fixture_only"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0060","collector":"illustrative-lab-collector","observation":{"service":"LabService","action":"install","executable":"C:\\Lab\\service.exe","actor":"lab-admin"}}]}}