T1014

Rootkit

Linux · macOS · Windows1 piece on this siteT1014 on attack.mitre.org

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware.
MITRE ATT&CK 19.2, retrieved 2026-09-12

Read

Analyses, case studies, guides, references and interview questions.

ReferenceCONSTRUCTED

Memory forensics cheat sheet: acquisition order and the Volatility 3 plugins that answer real questions

What to capture before you touch anything else, how to check the image is usable, and the Volatility 3 plugins grouped by the question they answer, with what each one cannot tell you.

T1014

how MITRE says to see it

Detection of Kernel/User-Level Rootkit Behavior Across Platforms

Unauthorized or anomalous loading of kernel-mode drivers or DLLs, concealed services, or abnormal modification of boot components indicative of rootkit activity.
Abnormal loading of kernel modules, direct tampering with /dev, /proc, or LD_PRELOAD behaviors hiding processes or files.
Execution of unsigned kernel extensions (KEXTs), tampering with LaunchDaemons, or userspace hooks into system libraries.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.