Rootkit (T1014) is a stealth technique. Adversaries use rootkits to hide the presence of programs, files, network connections, services, drivers and other system components. MITRE lists Linux, macOS and Windows.
How attackers use it
MITRE explains that rootkits hide malware by intercepting or hooking operating system API calls that supply system information, then modifying the results. A rootkit may sit at the user level, the kernel level, or lower, including a hypervisor or system firmware. Rootkits that modify boot sectors are called bootkits and target the boot process.
The consequence is that the tools you ask for answers may be the ones being lied to. A process list from an infected host may leave out the process.
How to detect it
MITRE's analytic includes:
- Windows: unauthorized or odd loading of kernel-mode drivers or DLLs, concealed services, or unusual modifications of boot components.
- Linux: unusual loading of kernel modules, tampering with /dev or /proc, or LD_PRELOAD behavior that hides processes or files.
- macOS: execution of unsigned kernel extensions, tampering with LaunchDaemons, or userspace hooks in system libraries.
Because the host may lie, the best signals come from outside it. Compare a host's own view with what the network shows, such as connections that appear in firewall logs but not in local connection lists. Collect driver and module load events centrally, so an attacker cannot erase them locally.
How to reduce the risk
MITRE lists no mitigations for this technique because it abuses features of the operating system at a low level. Practical steps: only allow signed kernel modules and drivers where your platform supports it, protect boot integrity features, and rebuild a host from a trusted image if you suspect a rootkit, since cleaning in place is hard to trust.
Quick check
Why can a rootkit make local tools unreliable?
It hooks the operating system calls those tools use and changes the results, so the host may hide its own malicious processes, files or connections.
