{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0851","id":"T0851","name":"Rootkit","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0851","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"c51f83f1f2e7354827fdd0b183797450dd63267b228a0f53788690efbb6b0745","description":"Adversaries may deploy rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting and modifying operating-system API calls that supply system information. Rootkits or rootkit-enabling functionality may reside at the user or kernel level in the operating system, or lower. (Citation: Enterprise ATT&CK January 2018)   \n\nFirmware rootkits that affect the operating system yield nearly full control of the system. While firmware rootkits are normally developed for the main processing board, they can also be developed for the I/O that is attached to an asset. Compromise of this firmware allows the modification of all of the process variables and functions the module engages in. This may result in commands being disregarded and false information being fed to the main device. By tampering with device processes, an adversary may inhibit its expected response functions and possibly enable [Impact](https://attack.mitre.org/tactics/TA0105).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0851","external_id":"T0851"},{"source_name":"Enterprise ATT&CK January 2018","description":"Enterprise ATT&CK 2018, January 11 Rootkit Retrieved. 2018/05/16 ","url":"https://attack.mitre.org/wiki/Technique/T1014"}],"platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0004","name":"Firmware Modification","page":"telemetry/DC0004/","kind":"attack_component","category":"Host state and inventory","description":"Changes to firmware state or a firmware update observation on a device.","collection_focus":"Collect approved OEM firmware inventory/update audit and compare version or measured hashes against a known baseline. Use read-only vendor-supported interfaces.","providers":[{"name":"osquery","scope":"Scheduled host-state queries; supported tables and privileges vary by OS. Select a table that actually exposes the required object.","source_id":"osquery"},{"name":"Linux Audit plus inventory snapshots","scope":"Events explain changes; snapshots describe state at collection time.","source_id":"linux"}],"configuration":["Define the inventory query, allowed host set, interval and least-privileged reader. Store a stable asset ID, observation time and collector version.","Keep successive snapshots and calculate additions, removals and changed attributes. Pair state changes with audit events when available.","Export collector health and missed-poll counts so a missing snapshot is not misclassified as a missing asset."],"configuration_example":null,"required_fields":["asset_id","firmware_before","firmware_after","change_ticket"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0004","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-device-1","firmware_before":"1.0-lab","firmware_after":"1.1-lab","change_ticket":"LAB-42"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Snapshots miss short-lived objects and do not identify who caused a change. A generic inventory agent is not guaranteed to expose firmware or kernel-level details.","sources":[{"id":"osquery","title":"osquery scheduled configuration","url":"https://github.com/osquery/osquery/blob/master/docs/wiki/deployment/configuration.md"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Compare authorized state snapshots: first-seen drivers/services/modules, unexpected configuration drift and integrity changes. Record collection cadence; absence in a sample is not evidence of deletion."},{"id":"DC0016","name":"Module Load","page":"telemetry/DC0016/","kind":"attack_component","category":"Endpoint activity","description":"A module or library being loaded into a running process.","collection_focus":"Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","image_loaded","signed","action"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"ics/T0851","id":"T0851","name":"Rootkit","domain":"ics","platforms":["Embedded","Windows","Linux","Network Devices"],"environments":["cloud-hosted-endpoint","ics-ot","network-infrastructure","onprem"],"source_url":"https://attack.mitre.org/techniques/T0851","technique_page":"techniques/ics/T0851/","page":"detections/ics/T0851/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":4,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0780","name":"Detection of Rootkit","url":"https://attack.mitre.org/detectionstrategies/DET0780","stix_id":"x-mitre-detection-strategy--04bcf663-e6cd-42bf-8864-f4d1ad345263","relationship_id":"relationship--20006064-4e2f-4106-a6b4-ee8b4c739c9b","description":"","analytics":[{"id":"AN1912","name":"Analytic 1912","guidance":"Periodic or event-triggered integrity verification identifies a discrepancy between a field device's self-reported diagnostic state and an independently verified hardware/firmware fingerprint, indicating the device's reporting layer has been compromised. MITRE explicitly notes firmware/module rootkits 'can also be developed for the Input/Output (I/O) that is attached to an asset.'. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance. Monitoring reality: this is an integrity/posture analytic, not a universal streaming field-device event; collection cadence depends on the vendor integrity interface, asset-management system, or acquisition workflow.","url":"https://attack.mitre.org/detectionstrategies/DET0780#AN1912","platforms":["Embedded"],"tuning":[{"field":"FirmwareIntegrityScanSchedule","description":"Frequency of out-of-band firmware integrity verification."}],"log_sources":[{"component_id":"DC0004","component":"Firmware Modification","name":"assetinventory:FirmwareHash","channel":"device-reported firmware hash/version does not match independently verified value obtained through vendor integrity tool or physical inspection","platforms":["Embedded"],"analytic_id":"AN1912","source_url":"https://attack.mitre.org/detectionstrategies/DET0780#AN1912","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0004/"}]},{"id":"AN2146","name":"Analytic 2146","guidance":"Real-time monitoring identifies inconsistencies between auditd-recorded process activity and what /proc reports, or kernel module loads from non-standard paths on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0780#AN2146","platforms":["Linux"],"tuning":[{"field":"FirmwareIntegrityScanSchedule","description":"Frequency of out-of-band firmware integrity verification."}],"log_sources":[{"component_id":"DC0016","component":"Module Load","name":"auditd:SYSCALL","channel":"Linux Audit SYSCALL/EXECVE/SOCKADDR records (configured audit rule): syscall=init_module/finit_module; kernel module loaded from a path or hash not in the authorized ICS host module baseline","platforms":["Linux"],"analytic_id":"AN2146","source_url":"https://attack.mitre.org/detectionstrategies/DET0780#AN2146","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0016/"}]},{"id":"AN2167","name":"Analytic 2167","guidance":"Real-time monitoring identifies Industrial Control System (ICS) host telemetry gaps -- process lists differing between Windows Management Instrumentation (WMI) and direct enumeration, or unexpected kernel driver loads from unexpected paths -- suggesting kernel-level manipulation of what the Operating System (OS) reports. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0780#AN2167","platforms":["Windows"],"tuning":[{"field":"FirmwareIntegrityScanSchedule","description":"Frequency of out-of-band firmware integrity verification."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"edr:TelemetryCompare","channel":"process enumeration discrepancy between Windows Management Instrumentation (WMI) and direct process listing","platforms":["Windows"],"analytic_id":"AN2167","source_url":"https://attack.mitre.org/detectionstrategies/DET0780#AN2167","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]},{"id":"AN2185","name":"Analytic 2185","guidance":"Real-time monitoring identifies Industrial Control System (ICS) network device telemetry gaps -- Simple Network Management Protocol (SNMP) polling returning inconsistent results, syslog sequence gaps -- suggesting kernel-level manipulation of device-reported state. OT operational-fidelity gate: Alert only when execution violates an approved signer/hash/path/parent/process or tool allowlist, or originates from an unauthorized user/tool, and is tied to an OT asset or follow-on OT-relevant action. Suppress vendor-signed software, approved engineering utilities, diagnostics, patching, backup, and documented maintenance.","url":"https://attack.mitre.org/detectionstrategies/DET0780#AN2185","platforms":["Network Devices"],"tuning":[{"field":"FirmwareIntegrityScanSchedule","description":"Frequency of out-of-band firmware integrity verification."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"networkdevice:snmp","channel":"Simple Network Management Protocol (SNMP) polling inconsistency or syslog sequence gap suggesting telemetry manipulation","platforms":["Network Devices"],"analytic_id":"AN2185","source_url":"https://attack.mitre.org/detectionstrategies/DET0780#AN2185","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0004","name":"Firmware Modification","tag":"Firmware Modification","page":"telemetry/DC0004/","kind":"attack_component"},{"id":"DC0016","name":"Module Load","tag":"Module Load","page":"telemetry/DC0016/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"One of [Stuxnet](https://attack.mitre.org/software/S0603)'s rootkits is contained entirely in the fake s7otbxdx.dll. In order to continue existing undetected on the PLC it needs to account for at least the following situations: read requests for its own malicious code blocks, read requests for infected blocks (OB1, OB35, DP_RECV), and write requests that could overwrite Stuxnets own code. Stuxnet contains code to monitor and intercept these types of requests. The rootkit modifies these requests so that Stuxnets PLC code is not discovered or damaged. (Citation: Langer Stuxnet)","relationship_id":"relationship--f130282b-f681-455f-966b-55829842be92","references":[{"source_name":"Langer Stuxnet","description":"Ralph Langner. (2013, November). To Kill a Centrifuge: A Technical Analysis of What Stuxnet's Creators Tried to Achieve. Retrieved December 7, 2020.","url":"https://www.langner.com/wp-content/uploads/2017/03/to-kill-a-centrifuge.pdf"}]}],"actors":[],"mitigations":[{"id":"M0945","name":"Code Signing","url":"https://attack.mitre.org/mitigations/M0945","kind":"course-of-action","description":"Digital signatures may be used to ensure application DLLs are authentic prior to execution.\n","relationship_id":"relationship--2971151c-0e8a-4567-84dc-01cf5dd35005","references":[]},{"id":"M0947","name":"Audit","url":"https://attack.mitre.org/mitigations/M0947","kind":"course-of-action","description":"Audit the integrity of PLC system and application code functionality, such as the manipulation of standard function blocks (e.g., Organizational Blocks) that manage the execution of application logic programs. (Citation: IEC February 2019)\n","relationship_id":"relationship--5de6bf53-0a02-439b-a8d0-248fa9640a36","references":[{"source_name":"IEC February 2019","description":"IEC 2019, February Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components Retrieved. 2020/09/25 ","url":"https://webstore.iec.ch/publication/34421"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0851":"/ttp-simulation/techniques/ics/T0851/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0851","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0004","collector":"illustrative-lab-collector","observation":{"asset_id":"lab-device-1","firmware_before":"1.0-lab","firmware_after":"1.1-lab","change_ticket":"LAB-42"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0016","collector":"illustrative-lab-collector","observation":{"process_id":4200,"image_loaded":"C:\\Lab\\demo.dll","signed":false,"action":"load"}}]}}