t1014-rootkit

name	T1014_rootkit
description	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1014","defense-evasion","linux","macos","windows"]
technique_id	T1014
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Linux","macOS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1014
tech_stack	["linux","macos","windows"]
cwe_ids	["CWE-693"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1014 Rootkit

High-Level Description

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.

Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems.

Rootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, macOS, Windows

What to Check

• Identify if Rootkit technique is applicable to target environment
• Check Linux systems for indicators of Rootkit
• Check macOS systems for indicators of Rootkit
• Check Windows systems for indicators of Rootkit
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Loadable Kernel Module based Rootkit

Loadable Kernel Module based Rootkit

Supported Platforms: linux Elevation Required: Yes

sudo insmod #{rootkit_path}/#{rootkit_name}.ko

Dependencies:

• The kernel module must exist on disk at specified location (#{rootkit_path}/#{rootkit_name}.ko)

Atomic Test 2: Loadable Kernel Module based Rootkit

Loadable Kernel Module based Rootkit

Supported Platforms: linux Elevation Required: Yes

sudo modprobe #{rootkit_name}

Dependencies:

• The kernel module must exist on disk at specified location (#{rootkit_source_path}/#{rootkit_name}.ko)