Rootkit T1014
Tactic: Stealth
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Events covered
7 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 6 | Driver loaded |
| ESF | kextload | Kernel Extension Load |
| ESF | kextunload | Kernel Extension Unload |
| Linux-Auditd | Event ID 1300 | SYSCALL |
| Service-Control-Manager | Event ID 7045 | A service was installed in the system. |
| Sysmon-for-Linux | Event ID 1 | Process Create |
| Sysmon-for-Linux | Event ID 11 | File created |
Authoring guide
These 38 rules share fields, values, and exclusions.
Fields filtered most (38 distinct)
These fields appear most often in rule filters.
Top indicator values (516 distinct)
These values appear most often in rule predicates.
Exclusions (361 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Domain: Endpoint
Sigma 2 rules
Elastic 30 rules
- BPF Program or Map Load via bpftool
- BPF Program Tampering via bpftool
- Driver Dropped by Untrusted Executable
- Execution of a File Dropped from Kernel Mode
- Kernel Driver Load
- Kernel Driver Load by non-root User
- Kernel Instrumentation Discovery via kprobes and tracefs
- Kernel Load or Unload via Kexec Detected
- Kernel Module Load from Unusual Location
- Kernel Module Load via Built-in Utility
- Kernel Module Loaded with Tainting Flags
- Kernel Object File Creation
- Kernel Seeking Activity
- Kernel Unpacking Activity
- Loadable Kernel Module Configuration File Creation
- Loadable Kernel Module Load Followed by Log Clearing
- Loadable Kernel Module Load via Forked Memory File Descriptor
- Loadable Kernel Module Loaded via Loader
- Loadable Kernel Module Loaded via Unusual Parent
- Network Activity Detected via Kworker
- Potential Loadable Kernel Module Load via Memory File Descriptor
- Potential Persistence via File Modification
- Suspicious File Creation via Kworker
- Suspicious Kworker UID Elevation
- Suspicious Usage of bpf_probe_write_user Helper
- Tainted Kernel Module Load
- Tainted Out-Of-Tree Kernel Module Load
- UID Elevation from Previously Unknown Executable
- Unusual Execution from Kernel Thread (kthreadd) Parent
- Unusual Kill Signal
Splunk 5 rules
- Linux Auditd Kernel Module Enumeration
- Linux Kernel Module Enumeration
- Linux Medusa Rootkit
- Windows Driver Load Non-Standard Path
- Windows Drivers Loaded by Signature