Cross-source coverage
T1014 / ATT&CK
Rootkit
46 rules across 8 sources.
From MITRE ATT&CK 19.2
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems.
Rootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.
- Tactics
- Stealth
- Platforms
- Linux · macOS · Windows
- Telemetry
-
WinEventLog:SysmonWinEventLog:Systemauditd:EXECVElinux:osquerylinux:syslogmacos:unifiedlogmacos:osqueryfs:fsevents
How MITRE says to detect it DET0377
Detection of Kernel/User-Level Rootkit Behavior Across Platforms
Windows Analytic 1061
Unauthorized or anomalous loading of kernel-mode drivers or DLLs, concealed services, or abnormal modification of boot components indicative of rootkit activity.
WinEventLog:SysmonEventCode=6WinEventLog:SystemEventCode=7045WinEventLog:SysmonEventCode=11
Linux Analytic 1062
Abnormal loading of kernel modules, direct tampering with /dev, /proc, or LD_PRELOAD behaviors hiding processes or files.
auditd:EXECVENonelinux:osqueryfile_eventslinux:syslogkmod
macOS Analytic 1063
Execution of unsigned kernel extensions (KEXTs), tampering with LaunchDaemons, or userspace hooks into system libraries.
macos:unifiedlogsubsystem=com.apple.kextdmacos:osquerylaunch_daemonsfs:fseventsExtensions
elastic/detection-rules
23 rules| Detection | Severity | Format |
|---|---|---|
| Kernel Module Load from Unusual Location | High | Elastic TOML |
| Suspicious Usage of bpf_probe_write_user Helper | High | Elastic TOML |
| UID Elevation from Previously Unknown Executable | High | Elastic TOML |
| Unusual Kill Signal | High | Elastic TOML |
| BPF Program or Map Load via bpftool | Medium | Elastic TOML |
| BPF Program Tampering via bpftool | Medium | Elastic TOML |
| Kernel Driver Load by non-root User | Medium | Elastic TOML |
| Kernel Load or Unload via Kexec Detected | Medium | Elastic TOML |
| Kernel Module Loaded with Tainting Flags | Medium | Elastic TOML |
| Kernel Module Load via Built-in Utility | Medium | Elastic TOML |
+ 13 more from elastic/detection-rules → showing the 10 highest-severity
elastic/protections-artifacts
7 rules| Detection | Severity | Format |
|---|---|---|
| Driver Dropped by Untrusted Executable | Undefined | Elastic TOML |
| Execution of a File Dropped from Kernel Mode | Undefined | Elastic TOML |
| Loadable Kernel Module Loaded via Loader | Undefined | Elastic TOML |
| Loadable Kernel Module Loaded via Unusual Parent | Undefined | Elastic TOML |
| Loadable Kernel Module Load Followed by Log Clearing | Undefined | Elastic TOML |
| Loadable Kernel Module Load via Forked Memory File Descriptor | Undefined | Elastic TOML |
| Potential Loadable Kernel Module Load via Memory File Descriptor | Undefined | Elastic TOML |
splunk/security_content
5 rules| Detection | Severity | Format |
|---|---|---|
| Linux Auditd Kernel Module Enumeration | Undefined | SPL |
| Linux Kernel Module Enumeration | Undefined | SPL |
| Linux Medusa Rootkit | Undefined | SPL |
| Windows Driver Load Non-Standard Path | Undefined | SPL |
| Windows Drivers Loaded by Signature | Undefined | SPL |
chainguard-dev/osquery-defense-kit
4 rules| Detection | Severity | Format |
|---|---|---|
| Find a process which has a parent that is not listed in the process table | Undefined | osquery SQL |
| Finds processes that are apparently hidden by a rootkit | Undefined | osquery SQL |
| Finds unexpected device names, sometimes used for communication to a rootkit | Undefined | osquery SQL |
| Unusually tainted kernel - via a loaded kernel module | Undefined | osquery SQL |
socfortress/Wazuh-Rules
4 rules| Detection | Severity | Format |
|---|---|---|
| Kernel module insertion detected — possible rootkit activity (T1014) | High | Wazuh XML |
| Kernel module load via modprobe detected — possible rootkit activity (T1014) | High | Wazuh XML |
| Potential rootkit behavior — modification of ld.so.preload (T1014) | High | Wazuh XML |
| Suspicious script execution from non-standard path — potential user-space rootkit activity (T1014) | High | Wazuh XML |
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| Triple Cross eBPF Rootkit Install Commands | High | Sigma |
Wazuh Core Ruleset
1 rule| Detection | Severity | Format |
|---|---|---|
| Possible kernel level rootkit | High | Wazuh XML |
panther-labs/panther-analysis
1 rule| Detection | Severity | Format |
|---|---|---|
| OSSEC Rootkit Detected via Osquery | Medium | Panther Python |