Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1014: Rootkit

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. [1]

Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware. [2] Rootkits have been seen for Windows, Linux, and Mac OS X systems. [3] [4]

Rootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.

EnterpriseT1014TechniqueObject v2.0 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

Rootkits matter because they are designed to make compromise hard to see. Instead of only running malware, an adversary may hide files, processes, services, drivers, network connections, or lower-level components by altering what the operating system reports. For leaders, the practical issue is confidence: if a rootkit is plausible, normal endpoint and administrator views may be incomplete, so incident decisions may require trusted forensic collection, rebuild criteria, and validation outside the potentially compromised OS.

Executive priority

Treat T1014 as a resilience and assurance problem, not just a malware category. It affects how much trust the business can place in endpoint inventories, EDR alerts, server health checks, and incident scoping. Priority questions: which Linux, macOS, and Windows assets would create material business risk if hidden persistence existed; whether IR playbooks define when to isolate, acquire forensic evidence, or rebuild; and whether security teams can produce audit-ready evidence that kernel/user-level, boot/firmware-adjacent, and suspicious driver or system-component activity is reviewed. Relationship context shows this technique is mapped to multiple campaigns, groups, and malware families, including Windows, Linux, macOS, and UEFI/rootkit examples, so prioritization should focus on high-value servers, administrative workstations, infrastructure systems, and environments where visibility depends entirely on the host OS.

Technical view

ATT&CK lists this as an enterprise stealth technique for Linux, macOS, and Windows. Official detection text is not provided, but the related detection strategy DET0377 is named “Detection of Kernel/User-Level Rootkit Behavior Across Platforms,” which supports validating both user-level and kernel-level behavior. SOC and IR teams should test whether their tooling can identify inconsistencies between OS-reported state and independent evidence: hidden processes, unexpected kernel modules or drivers, altered shared libraries, suspicious services, unusual network connections, and boot or firmware-related persistence paths where relevant to linked ATT&CK techniques such as System Firmware and Bootkit. Relationship examples include Windows rootkits, Linux rootkits, macOS rootkit research, UEFI rootkit software, and malware that modifies shared libraries, so detection engineering should not assume this is a Windows-only problem.

Likely telemetry

  • Endpoint security and EDR telemetry for process, service, driver, module, and file activity on Windows, Linux, and macOS
  • Kernel module, driver load, and low-level system component inventory
  • File integrity and configuration monitoring for system paths, shared libraries, boot-related areas, and security-sensitive binaries
  • Network connection telemetry from both host and network perspectives to identify connections hidden from local tools
  • Authentication and remote access logs, especially for Linux servers and systems running OpenSSH or similar services

Detection direction

  • Validate coverage against the related DET0377 concept: kernel/user-level rootkit behavior across platforms, rather than only known malware signatures.
  • Compare multiple sources of truth. Rootkits may alter OS API responses, so discrepancies between host-reported state, EDR telemetry, network sensors, offline scans, and forensic tooling are especially important.
  • Tune for suspicious driver/module loading, unexpected system library changes, hidden or mismatched process and network views, and persistence indicators near boot or firmware-related components when applicable.
  • Account for false positives from legitimate security tools, virtualization software, endpoint agents, and approved kernel extensions or drivers; maintain an authorized baseline for high-value systems.
  • Use relationship context to guide testing: ATT&CK maps this technique to software including Hikit, Uroburos, Zeroaccess, Hacking Team UEFI Rootkit, HIDEDRV, Umbreon, Ebury, HiddenWasp, LoJax, Winnti for Linux, Skidmap, and others, but local detections should be behavior-led rather than assuming one family.

Mitigation priorities

  • Prioritize hardening and monitoring of high-value Linux, macOS, and Windows assets where hidden persistence would materially affect operations or incident confidence.
  • Maintain strong control over privileged access because rootkit installation or enabling functionality commonly implies high-trust system modification, even though this ATT&CK object does not specify an installation method.
  • Baseline approved drivers, kernel modules, system libraries, services, and boot-related components; investigate unauthorized deviations quickly.
  • Ensure IR playbooks include criteria for distrust of the running OS, forensic acquisition, offline analysis, credential reset sequencing, and rebuild or reimage decisions.
  • Where supported by the environment, use secure boot, firmware/boot integrity validation, and controlled driver/module loading as assurance layers, while recognizing the ATT&CK object also references lower-level rootkit locations including hypervisor and system firmware contexts.
Analyst notes and limits

MITRE does not provide an official detection paragraph for T1014 in the supplied fields. The strongest supplied detection anchor is the relationship to DET0377. The object’s tactic is stealth, and platforms are Linux, macOS, and Windows. Relationship context is broad: ATT&CK maps T1014 to multiple groups, campaigns, and software families, including examples involving kernel-mode, Linux, Windows, macOS, OpenSSH/shared-library modification, and UEFI rootkit concepts. Use these relationships to shape defensive validation, not to infer current activity in a specific environment.

This take is limited to the supplied ATT&CK fields, external references, and relationships. It does not establish that any organization is exposed, that any actor is currently targeting the reader, or that a given tool will detect rootkits. Local asset criticality, privileged access paths, endpoint telemetry quality, firmware/boot visibility, and forensic readiness determine practical coverage.

Official MITRE ATT&CK definition

Rootkit

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. [1]

Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware. [2] Rootkits have been seen for Windows, Linux, and Mac OS X systems. [3] [4]

Rootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

Associated objects

Groups, software, and campaigns

Group Enterprise

G0096: APT41

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]

Group Enterprise

G0106: Rocke

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.[1]

Group Enterprise

G0139: TeamTNT

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.[1][2][3][4][5][6][7][8][9]

Group Enterprise

G0007: APT28

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165.[1][2] This group has been active since at least 2004.[3][4][5][6][7][8][9][10][11][12][13]

APT28 reportedly compromised the Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016 in an attempt to interfere with the U.S. presidential election.[5] In 2018, the US indicted five GRU Unit 26165 officers associated with APT28 for cyber operations (including close-access operations) conducted between 2014 and 2018 against the World Anti-Doping Agency (WADA), the US Anti-Doping Agency, a US nuclear facility, the Organization for the Prohibition of Chemical Weapons (OPCW), the Spiez Swiss Chemicals Laboratory, and other organizations.[14] Some of these were conducted with the assistance of GRU Unit 74455, which is also referred to as Sandworm Team.

Group Enterprise

G1048: UNC3886

UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pacific-Japan (APJ) regions. UNC3886 has displayed a deep understanding of edge devices and virtualization technologies through the exploitation of zero-day vulnerabilities and the use of novel malware families and utilities.[1][2]

Malware Enterprise

S0377: Ebury

Ebury is an OpenSSH backdoor and credential stealer targeting Linux servers and container hosts developed by Windigo. Ebury is primarily installed through modifying shared libraries (`.so` files) executed by the legitimate OpenSSH program. First seen in 2009, Ebury has been used to maintain a botnet of servers, deploy additional malware, and steal cryptocurrency wallets, credentials, and credit card details.[1][2][3][4]

Linux
Malware Enterprise

S0484: Carberp

Carberp is a credential and information stealing malware that has been active since at least 2009. Carberp's source code was leaked online in 2013, and subsequently used as the foundation for the Carbanak backdoor.[1][2][3]

Windows
Malware Enterprise

S0458: Ramsay

Ramsay is an information stealing malware framework designed to collect and exfiltrate sensitive documents, including from air-gapped systems. Researchers have identified overlaps between Ramsay and the Darkhotel-associated Retro malware.[1][2]

Windows
Tool Enterprise

S0040: HTRAN

HTRAN is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks. [1][2]

LinuxWindows
Malware Enterprise

S0221: Umbreon

A Linux rootkit that provides backdoor access and hides from defenders.

Linux
Malware Enterprise

S0603: Stuxnet

Stuxnet was the first publicly reported malware to specifically target industrial control systems devices. Stuxnet is a large and complex malware that utilized multiple behaviors, including numerous zero-day vulnerabilities, a sophisticated Windows rootkit, and network infection routines.[1][2][3][4] Stuxnet was discovered in 2010, with some components being used as early as November 2008.[1]

Windows
Malware Enterprise

S1105: COATHANGER

COATHANGER is a remote access tool (RAT) targeting FortiGate networking appliances. First used in 2023 in targeted intrusions against military and government entities in the Netherlands along with other victims, COATHANGER was disclosed in early 2024, with a high confidence assessment linking this malware to a state-sponsored entity in the People's Republic of China. COATHANGER is delivered after gaining access to a FortiGate device, with in-the-wild observations linked to exploitation of CVE-2022-42475. The name COATHANGER is based on a unique string in the malware used to encrypt configuration files on disk: “She took his coat and hung it up”.[1]

LinuxNetwork Devices
Malware Enterprise

S0394: HiddenWasp

HiddenWasp is a Linux-based Trojan used to target systems for remote control. It comes in the form of a statically linked ELF binary with stdlibc++.[1]

Linux
Campaign Enterprise

C0046: ArcaneDoor

ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. ArcaneDoor is associated with the deployment of the custom backdoors Line Runner and Line Dancer. ArcaneDoor is attributed to a group referred to as UAT4356 or STORM-1849, and is assessed to be a state-sponsored campaign.[1][2]

Campaign Enterprise

C0056: RedPenguin

The RedPenguin project was launched by Juniper in July 2024 to investigate reported malware infections of Juniper MX Series routers. RedPenguin activity was separately attributed to UNC3886 and included the deployment of multiple custom versions of the publicly-available TINYSHELL backdoor on Juniper routers.[1][2]

Relationship explorer

All related ATT&CK context

uses · Malware S0377: Ebury Enterprise uses · Group G0044: Winnti Group Enterprise detects · Detection Strategy DET0377: Detection of Kernel/User-Level Rootkit Behavior Across Platforms Enterprise uses · Group G0096: APT41 Enterprise uses · Group G0106: Rocke Enterprise uses · Malware S0484: Carberp Enterprise uses · Malware S0458: Ramsay Enterprise uses · Malware S0502: Drovorub Enterprise uses · Tool S0040: HTRAN Enterprise uses · Malware S0135: HIDEDRV Enterprise uses · Group G0139: TeamTNT Enterprise uses · Malware S0468: Skidmap Enterprise uses · Malware S0221: Umbreon Enterprise uses · Malware S0603: Stuxnet Enterprise uses · Malware S1105: COATHANGER Enterprise uses · Malware S0047: Hacking Team UEFI Rootkit Enterprise uses · Malware S0394: HiddenWasp Enterprise uses · Malware S0601: Hildegard Enterprise uses · Malware S1186: Line Dancer Enterprise uses · Campaign C0046: ArcaneDoor Enterprise uses · Group G0007: APT28 Enterprise uses · Malware S0009: Hikit Enterprise uses · Malware S1220: MEDUSA Enterprise uses · Malware S1219: REPTILE Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
f486763d8542145c...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 2.0 Current bundle f486763d8542…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Symantec Windows Rootkits

    Symantec. (n.d.). Windows Rootkit Overview. Retrieved December 21, 2017.

    Open source URL
  2. [2]
    Wikipedia Rootkit

    Wikipedia. (2016, June 1). Rootkit. Retrieved June 2, 2016.

    Open source URL
  3. [3]
    CrowdStrike Linux Rootkit

    Kurtz, G. (2012, November 19). HTTP iframe Injecting Linux Rootkit. Retrieved December 21, 2017.

    Open source URL
  4. [4]
    BlackHat Mac OSX Rootkit

    Pan, M., Tsai, S. (2014). You can’t see me: A Mac OS X Rootkit uses the tricks you haven't known yet. Retrieved December 21, 2017.

    Open source URL
  5. [5]
    mitre-attack T1014
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use