tfMITRE ATT&CK technique

Rootkit T1014

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: Menachem Goldstein

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. [1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 73% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 17%

Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 14%

Tools & malware86th percentile · 86% of ATT&CK techniques have fewer tools implementing them.

Detection rules67th pct

Detection rules67th percentile · 64% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Rootkit T1014

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 31 May 2017
Last modified: 12 May 2026
Contributor: Menachem Goldstein

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 25%

Threat groups75th percentile · 73% of ATT&CK techniques have fewer threat groups attributed.

CampaignsTop 17%

Campaigns83rd percentile · 73% of ATT&CK techniques have fewer campaigns recorded.

Tools & malwareTop 14%

Tools & malware86th percentile · 86% of ATT&CK techniques have fewer tools implementing them.

Detection rules67th pct

Detection rules67th percentile · 64% of ATT&CK techniques have fewer detection rules written.

Rootkit MITRE reference T1014

Top 25%of all ATT&CK techniques for number of groups

6 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has used the publicly available rootkits REPTILE and MEDUSA on targeted VMs.1

created 2025-05-291 reference

TeamTNTG0139 ↗

Has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.1 2

created 2021-10-012 references

RockeG0106 ↗

Has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.1

created 2020-05-261 reference

APT41G0096 ↗

Deployed rootkits on Linux systems.1 2

created 2019-09-232 referencesaka Wicked Panda

Winnti GroupG0044 ↗

Used a rootkit to modify typical server functionality.1

created 2017-05-311 referenceaka Blackfly

APT28G0007 ↗

Has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.1 2

created 2017-05-312 referencesaka IRON TWILIGHT

All 6 groups for this technique

2 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.

RedPenguinC0056 ↗

During RedPenguin, UNC3886 used rootkits such as REPTILE and MEDUSA.1

2024–2025

ArcaneDoorC0046 ↗

Included hooking the processHostScanReply() function on victim Cisco ASA devices.1

2023–2024

All 2 campaigns for this technique

Data component	Name	Channel
File CreationDC0039	WinEventLog:Sysmon	EventCode=11
Service CreationDC0060	WinEventLog:System	EventCode=7045
Driver LoadDC0079	WinEventLog:Sysmon	EventCode=6

Data component

Name

Channel

File CreationDC0039

WinEventLog:Sysmon

EventCode=11

Service CreationDC0060

WinEventLog:System

EventCode=7045

Driver LoadDC0079

WinEventLog:Sysmon

EventCode=6

Field	What you tune
DriverSignatureStatus	Signed vs unsigned drivers; many environments restrict unsigned drivers, but some legacy systems allow them.
TargetDirectory	Suspicious driver or DLL drop locations, e.g., \System32\Drivers\ or \Temp\
UserContext	Rootkit installation via admin or SYSTEM account.

Field

What you tune

DriverSignatureStatus

Signed vs unsigned drivers; many environments restrict unsigned drivers, but some legacy systems allow them.

TargetDirectory

Suspicious driver or DLL drop locations, e.g., \System32\Drivers\ or \Temp\

UserContext

Rootkit installation via admin or SYSTEM account.

Data component	Name	Channel
Module LoadDC0016	linux:syslog	kmod
Process CreationDC0032	auditd:EXECVE	—
File ModificationDC0061	linux:osquery	file_events

Field	What you tune
MonitoredDirectories	Directories where kernel modules or tampering could be staged (e.g., /lib/modules/).
ModuleNamePattern	Regex or heuristic match to anomalous module names (e.g., suspicious entropy or gibberish).
LD_PRELOAD	Monitor presence of suspicious preload values that mask processes or files.

Data component	Name	Channel
Module LoadDC0016	macos:unifiedlog	subsystem=com.apple.kextd
Service CreationDC0060	macos:osquery	launch_daemons
File ModificationDC0061	fs:fsevents	Extensions

Field	What you tune
KextSignatureStatus	Allowable level of unsigned/3rd-party kernel extensions varies by organization.
KextLoadOrigin	Detect whether the extension was loaded by an untrusted process or non-root user.
AnomalousLaunchAgent	Detection tuned based on deviation from known/approved LaunchDaemon plist files.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Rootkit Discovery System Information Discovery	-	medium	Teoderick Contreras, Splunk	2024-08-09	2026-05-13	d1b088de-c47a-4572-9339-bdcc26493b32
Splunk	The following analytic identifies the use of the 'kmod' process to list kernel modules on a Linux system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Stealth Rootkit Discovery System Information Discovery	-	medium	Michael Haag, Splunk	2022-06-17	2026-10-09	6df99886-0e04-4c11-8b88-325747419278
Splunk	This detection identifies file creation events associated with the installation of the Medusa rootkit, a userland LD_PRELOAD-based rootkit known for deploying shared objects, loader binaries, and configuration files into specific system directories. (...)	Generic	stable	file_event	linux	Sysmon	Reconnaissance Gather Victim Identity Information Credentials Stealth Rootkit	-	medium	Raven Tait, Splunk	2022-04-26	2026-05-13	7add8520-71d5-43aa-b262-ee082b1f0238
	Detects default install commands of the Triple Cross eBPF rootkit based on the "deployer.sh" script	Generic	test	process_creation	linux	Sysmon	Stealth Rootkit	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-07-05	—	22236d75-d5a0-4287-bf06-c93b1770860f
Splunk	The following analytic detects the loading of new Kernel Mode Drivers from non-standard paths using Windows EventCode 7045. (...)	Generic	stable	service	windows	WinEventLog System	Privilege Escalation Exploitation for Privilege Escalation Stealth Rootkit	-	medium	Michael Haag, Splunk	2022-05-16	2026-05-13	9216ef3d-066a-4958-8f27-c84589465e62
Splunk	The following analytic identifies all drivers being loaded on Windows systems using Sysmon EventCode 6 (Driver Load). (...)	Hunting	stable	driver_load	windows	Sysmon	Privilege Escalation Exploitation for Privilege Escalation Stealth Rootkit	-	medium	Michael Haag, Splunk	2022-04-04	2026-05-13	d2d4af6a-6c2b-4d79-80c5-fc2cf12a2f68

Title

Description

Rootkit T1014

Rootkit T1014

Rootkit MITRE reference T1014

Rootkit MITRE reference T1014

Offense vs defense T1014

Rootkit detection strategy DET0377

Detection of Kernel/User-Level Rootkit Behavior Across Platforms

Log sources

Tunable fields

Log sources

Tunable fields

Log sources

Tunable fields

Rootkit detections T1014

Rootkit detections T1014