T1014 Rootkit — Attack Simulation

DC0079 collection page — Collect Sysmon DriverLoad (6) and retain image path, hash and signature result; distinguish load from file installation.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: driver_path, action, signature_status.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0079",
  "collector": "illustrative-lab-collector",
  "observation": {
    "driver_path": "C:\\Lab\\demo.sys",
    "action": "load",
    "signature_status": "lab_fixture_only"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0039 collection page — Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, path, action, size_bytes.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0039",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "path": "C:\\Lab\\demo.txt",
    "action": "create",
    "size_bytes": 64
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0061 collection page — Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: path, attribute, before, after.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0061",
  "collector": "illustrative-lab-collector",
  "observation": {
    "path": "C:\\Lab\\demo.txt",
    "attribute": "content_hash",
    "before": "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
    "after": "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0016 collection page — Scope Sysmon ImageLoad (7) to lab processes/paths; retain module hash, signer and destination process. Inventory alone does not prove a module loaded.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_id, image_loaded, signed, action.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0016",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_id": 4200,
    "image_loaded": "C:\\Lab\\demo.dll",
    "signed": false,
    "action": "load"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.

Providers and collection configuration

• Microsoft Sysmon: Windows event-based collection; enable the event types needed below.
• Linux Audit: Linux alternative for supported system-call and file events; different semantics and fields.
• Apple Endpoint Security clients: macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.

• On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.
• Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.
• For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms.

Required normalized fields: process_guid, image, parent_image, command_line, user.

<EventFiltering>
  <ProcessCreate onmatch="include">
    <Image condition="is">C:\Windows\System32\whoami.exe</Image>
  </ProcessCreate>
</EventFiltering>

This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0032",
  "collector": "illustrative-lab-collector",
  "observation": {
    "process_guid": "lab-process-001",
    "image": "C:\\Windows\\System32\\whoami.exe",
    "parent_image": "C:\\Windows\\System32\\cmd.exe",
    "command_line": "whoami",
    "user": "LAB\\analyst"
  }
}

Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.

DC0060 collection page — Collect service-install auditing through Audit Security System Extension where supported, plus Service Control Manager/System logs and the new service configuration.

Providers and collection configuration

• Windows Security auditing: Policy-dependent account, object, task and logon records on the host that performs the operation.

• Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.
• For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.
• Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*.

Required normalized fields: service, action, executable, actor.

Illustrative collection event

Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.

{
  "schema": "1200km.telemetry.example.v1",
  "synthetic": true,
  "timestamp": "2026-09-27T12:00:00Z",
  "telemetry_id": "DC0060",
  "collector": "illustrative-lab-collector",
  "observation": {
    "service": "LabService",
    "action": "install",
    "executable": "C:\\Lab\\service.exe",
    "actor": "lab-admin"
  }
}

Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.

MITRE detection strategy

1 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.

• Triple Cross eBPF Rootkit Install Commands — test; category: process_creation; product: linux.

• S0009 Hikit — malware.

  Hikit is a Rootkit that has been used by Axiom.[FireEye Hikit Rootkit] [FireEye HIKIT Rootkit Part 2]

  Exact relationship: relationship--aacb43b8-2d3a-40bc-9f7b-1acb5b2474f2
• S0012 PoisonIvy — malware.

  PoisonIvy starts a rootkit from a malicious file dropped to disk.[Symantec Darkmoon Aug 2005]

  Exact relationship: relationship--f8340d49-ee7a-4ade-988f-3660904a18bb
• S0022 Uroburos — malware.

  Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.[Kaspersky Turla][Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023]

  Exact relationship: relationship--eb74fa31-121d-4e43-9794-048a901f509a
• S0027 Zeroaccess — malware.

  Zeroaccess is a kernel-mode rootkit.[Sophos ZeroAccess]

  Exact relationship: relationship--da6aa745-9eb5-44d9-80f8-e9f542d106d2
• S0040 HTRAN — tool.

  HTRAN can install a rootkit to hide network connections from the host OS.[NCSC Joint Report Public Tools]

  Exact relationship: relationship--4b14d96b-1664-4072-a49a-3a990a13ca83
• S0047 Hacking Team UEFI Rootkit — malware.

  Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.[TrendMicro Hacking Team UEFI]

  Exact relationship: relationship--89433640-bf49-48b3-9f26-76423cd36f77
• S0135 HIDEDRV — malware.

  HIDEDRV is a rootkit that hides certain operating system artifacts.[ESET Sednit Part 3]

  Exact relationship: relationship--69b9edd8-c1a8-4cbd-bd94-9af0fdefe013
• S0221 Umbreon — malware.

  Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.[Umbreon Trend Micro]

  Exact relationship: relationship--7653431a-18ac-43da-8308-63c76ecf0c22
• S0377 Ebury — malware.

  Ebury acts as a user land rootkit using the SSH service.[ESET Ebury Oct 2017][ESET Ebury May 2024]

  Exact relationship: relationship--05a3d203-4b38-4f38-a015-dcfe3bdf9c07
• S0394 HiddenWasp — malware.

  HiddenWasp uses a rootkit to hook and implement functions on the system.[Intezer HiddenWasp Map 2019]

  Exact relationship: relationship--8a8e30e6-c226-4739-87de-bd98c104d211
• S0397 LoJax — malware.

  LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.[ESET LoJax Sept 2018]

  Exact relationship: relationship--e9f52758-d5aa-4a16-b614-ea756a0cf270
• S0430 Winnti for Linux — malware.

  Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.[Chronicle Winnti for Linux May 2019]

  Exact relationship: relationship--c85d86c0-8adc-42fc-b7c9-8ca33d9ac4b6
• S0458 Ramsay — malware.

  Ramsay has included a rootkit to evade defenses.[Eset Ramsay May 2020]

  Exact relationship: relationship--2962304a-f96e-4323-958f-f685eae97ac6
• S0468 Skidmap — malware.

  Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.[Trend Micro Skidmap]

  Exact relationship: relationship--759185fe-d576-43f5-afac-acd653e5fcf4
• S0484 Carberp — malware.

  Carberp has used user mode rootkit techniques to remain hidden on the system.[Prevx Carberp March 2011]

  Exact relationship: relationship--21b929b8-8fec-47a5-8f98-554a043f9de5
• S0502 Drovorub — malware.

  Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.[NSA/FBI Drovorub August 2020]

  Exact relationship: relationship--3da780a6-2bd0-47ce-b434-fe513abb7ee5
• S0572 Caterpillar WebShell — malware.

  Caterpillar WebShell has a module to use a rootkit on a system.[ClearSky Lebanese Cedar Jan 2021]

  Exact relationship: relationship--f16c71ae-99b1-4aff-b276-13eb7c3ad889
• S0601 Hildegard — malware.

  Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().[Unit 42 Hildegard Malware]

  Exact relationship: relationship--8f5fdbbc-73b1-48a6-9916-67c0baa0f66e
• S0603 Stuxnet — malware.

  Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.[Nicolas Falliere, Liam O Murchu, Eric Chien February 2011]

  Exact relationship: relationship--7c85cd06-5b92-4b5d-acf5-fdd12a73b289
• S0670 WarzoneRAT — malware.

  WarzoneRAT can include a rootkit to hide processes, files, and startup.[Check Point Warzone Feb 2020]

  Exact relationship: relationship--eeb368b7-52b9-4320-a34f-8f3235beb22f
• S1105 COATHANGER — malware.

  COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.[NCSC-NL COATHANGER Feb 2024]

  Exact relationship: relationship--8162c91d-b82d-4e19-9fac-5a7191e4aa17
• S1186 Line Dancer — malware.

  Line Dancer can hook both the crash dump process and the Autehntication, Authorization, and Accounting (AAA) functions on compromised machines to evade forensic analysis and authentication mechanisms.[Cisco ArcaneDoor 2024]

  Exact relationship: relationship--95283b95-4474-47ac-9e77-a1f4da968f9f
• S1219 REPTILE — malware.

  REPTILE has the ability to hook kernel functions and modify functions data to achieve rootkit functionality such as hiding processes and network connections.[Google Cloud Mandiant UNC3886 2024]

  Exact relationship: relationship--af3233ba-82e8-49d1-bce7-2b96aced774d
• S1220 MEDUSA — malware.

  MEDUSA is a rootkit with command execution and credential logging capabilities.[Google Cloud Mandiant UNC3886 2024]
  

  Exact relationship: relationship--add8d076-83a4-44cf-8e4c-90caa144e488

Loads Diamorphine kernel module, which hides itself and a processes.

Pinned Atomic procedure · 0b996469-48c6-46e2-8155-a17f8b6c2247 · linux · sh.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• repo: Url of the diamorphine github repo (type string; source default https://github.com/m0nad/Diamorphine/)
• rev: Revision of the github repo zip (type string; source default 898810523aa2033f582a4a5903ffe453334044f9)
• rootkit_name: Module name (type string; source default diamorphine)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• The kernel module must exist on disk at specified location (#{rootkit_name}.ko)

Uses libprocesshider to simulate rootkit behavior by hiding a specific process name via ld.so.preload (see also T1574.006).

Pinned Atomic procedure · 1338bf0c-fd0c-48c0-9e65-329f18e2c0d3 · linux · sh.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• repo: Url of the github repo zip (type string; source default https://github.com/gianlucaborello/libprocesshider/)
• rev: Revision of the github repo zip (type string; source default 25e0587d6bf2137f8792dc83242b6b0e5a72b415)
• library_path: Full path of the library to add to ld.so.preload (type string; source default /usr/local/lib/libprocesshider.so)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• The preload library must exist on disk at specified location (#{library_path})

Loadable Kernel Module based Rootkit

Pinned Atomic procedure · 75483ef8-f10f-444a-bf02-62eb0e48db6f · linux · sh.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• rootkit_source_path: Path to the rootkit source. Used when prerequisites are fetched. (type path; source default PathToAtomicsFolder/T1014/src/Linux)
• rootkit_name: Module name (type string; source default T1014)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• The kernel module must exist on disk at specified location (#{rootkit_source_path}/#{rootkit_name}.ko)

Loadable Kernel Module based Rootkit

Pinned Atomic procedure · dfb50072-e45a-4c75-a17e-a484809c8553 · linux · sh.

Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.

Source-defined inputs

• rootkit_source_path: Path to the rootkit source. Used when prerequisites are fetched. (type path; source default PathToAtomicsFolder/T1014/src/Linux)
• rootkit_path: Path To rootkit (type string; source default PathToAtomicsFolder/T1014/bin)
• rootkit_name: Module name (type string; source default T1014)

Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.

1 prerequisite definitions:

• The kernel module must exist on disk at specified location (#{rootkit_path}/#{rootkit_name}.ko)