T1014 · Rootkit · Sunturai

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

attack-patternenterprise-attackT1014

Rootkit

attack-pattern--0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or System Firmware. (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as Bootkits and specifically target the boot process of the operating system.

Created: May 31, 2017, 9:30 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

29 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Linux Kernel Module Enumeration	Informational	Splunk security content	Oct 13, 2026	Apache License 2.0
Kernel Object File Creation	Low	Elastic detection rules	Oct 6, 2026	Elastic License 2.0
UID Elevation from Previously Unknown Executable	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Load or Unload via Kexec Detected	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Kworker UID Elevation	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Tainted Out-Of-Tree Kernel Module Load	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Module Loaded with Tainting Flags	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Tainted Kernel Module Load	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Loadable Kernel Module Configuration File Creation	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious File Creation via Kworker	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Module Load from Unusual Location	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Driver Load by non-root User	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Driver Load	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Module Load via Built-in Utility	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
BPF Program or Map Load via bpftool	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Usage of bpf_probe_write_user Helper	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Execution from Kernel Thread (kthreadd) Parent	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Unpacking Activity	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Seeking Activity	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Instrumentation Discovery via kprobes and tracefs	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Unusual Kill Signal	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
BPF Program Tampering via bpftool	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Network Activity Detected via Kworker	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Persistence via File Modification	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Windows Drivers Loaded by Signature	Medium	Splunk security content	Aug 26, 2026	Apache License 2.0

Showing 25 of 29

Filter in the catalogue

External references

mitre-attackT1014Open reference

CrowdStrike Linux RootkitOpen reference

BlackHat Mac OSX Rootkit

Symantec Windows RootkitsOpen reference

Wikipedia RootkitOpen reference

Platforms

LinuxmacOSWindows

Kill chain phases

stealth

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object