T1014 — Rootkit

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.…

Sigma detection rules (3)

T1014 Rootkit

title: T1014 Rootkit
id: aa7677be-c095-4bcd-aea3-6fdf89b3fb0d
description: 'Detects unsigned driver loads (Sysmon EventID 6, Signed=false) as the Windows-observable proxy for rootkit/kernel-level hiding components -- rootkits commonly load unsigned or improperly-signed kernel drivers to intercept OS APIs. Retargeted from an invalid service:system + EventID 6 pairing (EventID 6/DriverLoad is a Sysmon-only event, not part of the Windows System log) to product:windows/service:sysmon, the correct channel for this EventID. Tune using: TargetDirectory, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1014
author: Shahrukh Khan
date: 2026-04-21
license: MIT
tags:
  - attack.stealth
  - attack.t1014

logsource:
  product: windows
  service: sysmon

detection:
  selection:
    EventID: '6'

  filter_signed:
    Signed: 'true'

  condition: selection and not filter_signed

falsepositives:
  - Test-signed or self-signed drivers used in dev/lab environments, and a small number of legitimate but unsigned third-party hardware drivers (older peripherals); baseline known-good unsigned drivers by ImageLoaded/hash before enforcing broadly.

level: high

T1014 Rootkit

title: T1014 Rootkit
id: e3a4f481-287a-4d3e-8604-db9833f5b039
description: 'Detection of Kernel/User-Level Rootkit Behavior Across Platforms. (Retargeted to auditd telemetry that actually captures this techniques behavior; see logsource below.) Adds a file-event selection for writes to /etc/ld.so.preload and /etc/ld.so.conf.d/, the primary persistent LD_PRELOAD-based rootkit mechanism, since the prior EXECVE-only LD_PRELOAD check only caught inline env-prefixed invocations (env LD_PRELOAD=x cmd) and missed the on-disk persistence path. Tune using: MonitoredDirectories, ModuleNamePattern, LD_PRELOAD.'
references:
  - https://attack.mitre.org/techniques/T1014
author: Shahrukh Khan
date: 2026-05-19
license: MIT
tags:
  - attack.stealth
  - attack.t1014

logsource:
  product: linux
  service: auditd

detection:
  selection_kmod:
    type: EXECVE
    a0|endswith:
      - '/insmod'
      - '/modprobe'
  selection_preload_exec:
    type: EXECVE
    a1|contains: 'LD_PRELOAD='
  selection_preload_file:
    type: PATH
    nametype: CREATE
    name|contains:
      - '/etc/ld.so.preload'
      - '/etc/ld.so.conf.d/'

  condition: 1 of selection_*

falsepositives:
  - Legitimate kernel module loading during driver installation/updates; LD_PRELOAD is also used by legitimate profiling/debugging tool wrappers. The ld.so.preload/ld.so.conf.d file selection only fires on nametype CREATE (new file / first-time persistence, the common case since ld.so.preload does not exist by default); an attacker modifying an already-existing ld.so.preload would show as nametype NORMAL paired with a write-capable SYSCALL open, which this rule does not separately correlate -- a known detection gap.

level: high

T1014 Rootkit

title: T1014 Rootkit
id: ea472a17-d849-4e17-926f-e090962b7b2d
description: 'Detection of Kernel/User-Level Rootkit Behavior Across Platforms. (Retargeted to the image_load macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: KextSignatureStatus, KextLoadOrigin, AnomalousLaunchAgent.'
references:
  - https://attack.mitre.org/techniques/T1014
author: Shahrukh Khan
date: 2026-05-05
license: MIT
tags:
  - attack.stealth
  - attack.t1014

logsource:
  category: image_load
  product: macos

detection:
  selection:
    ImageLoaded|endswith: '.kext'
  selection_path:
    ImageLoaded|contains:
      - '/Library/Extensions/'
      - '/System/Library/Extensions/'
  filter_apple:
    ImageLoaded|startswith: '/System/Library/Extensions/AppleKext'
  condition: selection and selection_path and not filter_apple

falsepositives:
  - Legitimate third-party kernel extensions such as VPN clients or antivirus drivers loading during boot.

level: critical

Explore