Cross-source coverage

T1014 / ATT&CK

Rootkit

46 rules across 8 sources.

From MITRE ATT&CK 19.2

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.

Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems.

Rootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.

Tactics
Stealth
Platforms
Linux · macOS · Windows
Telemetry
WinEventLog:SysmonWinEventLog:Systemauditd:EXECVElinux:osquerylinux:syslogmacos:unifiedlogmacos:osqueryfs:fsevents

How MITRE says to detect it DET0377

Detection of Kernel/User-Level Rootkit Behavior Across Platforms

Windows Analytic 1061

Unauthorized or anomalous loading of kernel-mode drivers or DLLs, concealed services, or abnormal modification of boot components indicative of rootkit activity.

  • WinEventLog:Sysmon EventCode=6
  • WinEventLog:System EventCode=7045
  • WinEventLog:Sysmon EventCode=11

Linux Analytic 1062

Abnormal loading of kernel modules, direct tampering with /dev, /proc, or LD_PRELOAD behaviors hiding processes or files.

  • auditd:EXECVE None
  • linux:osquery file_events
  • linux:syslog kmod

macOS Analytic 1063

Execution of unsigned kernel extensions (KEXTs), tampering with LaunchDaemons, or userspace hooks into system libraries.

  • macos:unifiedlog subsystem=com.apple.kextd
  • macos:osquery launch_daemons
  • fs:fsevents Extensions

elastic/detection-rules

23 rules
Detection Severity Format
Kernel Module Load from Unusual Location High Elastic TOML
Suspicious Usage of bpf_probe_write_user Helper High Elastic TOML
UID Elevation from Previously Unknown Executable High Elastic TOML
Unusual Kill Signal High Elastic TOML
BPF Program or Map Load via bpftool Medium Elastic TOML
BPF Program Tampering via bpftool Medium Elastic TOML
Kernel Driver Load by non-root User Medium Elastic TOML
Kernel Load or Unload via Kexec Detected Medium Elastic TOML
Kernel Module Loaded with Tainting Flags Medium Elastic TOML
Kernel Module Load via Built-in Utility Medium Elastic TOML

+ 13 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

7 rules
Detection Severity Format
Driver Dropped by Untrusted Executable Undefined Elastic TOML
Execution of a File Dropped from Kernel Mode Undefined Elastic TOML
Loadable Kernel Module Loaded via Loader Undefined Elastic TOML
Loadable Kernel Module Loaded via Unusual Parent Undefined Elastic TOML
Loadable Kernel Module Load Followed by Log Clearing Undefined Elastic TOML
Loadable Kernel Module Load via Forked Memory File Descriptor Undefined Elastic TOML
Potential Loadable Kernel Module Load via Memory File Descriptor Undefined Elastic TOML

splunk/security_content

5 rules
Detection Severity Format
Linux Auditd Kernel Module Enumeration Undefined SPL
Linux Kernel Module Enumeration Undefined SPL
Linux Medusa Rootkit Undefined SPL
Windows Driver Load Non-Standard Path Undefined SPL
Windows Drivers Loaded by Signature Undefined SPL

chainguard-dev/osquery-defense-kit

4 rules
Detection Severity Format
Find a process which has a parent that is not listed in the process table Undefined osquery SQL
Finds processes that are apparently hidden by a rootkit Undefined osquery SQL
Finds unexpected device names, sometimes used for communication to a rootkit Undefined osquery SQL
Unusually tainted kernel - via a loaded kernel module Undefined osquery SQL

socfortress/Wazuh-Rules

4 rules
Detection Severity Format
Kernel module insertion detected — possible rootkit activity (T1014) High Wazuh XML
Kernel module load via modprobe detected — possible rootkit activity (T1014) High Wazuh XML
Potential rootkit behavior — modification of ld.so.preload (T1014) High Wazuh XML
Suspicious script execution from non-standard path — potential user-space rootkit activity (T1014) High Wazuh XML

SigmaHQ/sigma

1 rule
Detection Severity Format
Triple Cross eBPF Rootkit Install Commands High Sigma

Wazuh Core Ruleset

1 rule
Detection Severity Format
Possible kernel level rootkit High Wazuh XML

panther-labs/panther-analysis

1 rule
Detection Severity Format
OSSEC Rootkit Detected via Osquery Medium Panther Python

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.