H3XAOperational intelligence
Live analytical pictureEvidence before assessment
Threat intelligence / Technique

Rootkit

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.

Technique
TypeTechnique
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit) Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.

33 recorded

Relationships

mapped-to
from Install Rootkit
Technique
uses
from APT28
Group
uses
from APT41
Group
uses
from ArcaneDoor
Campaign
uses
from Carberp
Malware
uses
from Caterpillar WebShell
Malware
uses
from COATHANGER
Malware
uses
from Drovorub
Malware
uses
from Ebury
Malware
uses
from Hacking Team UEFI Rootkit
Malware
uses
from HiddenWasp
Malware
uses
from HIDEDRV
Malware
uses
from Hikit
Malware
uses
from Hildegard
Malware
uses
from HTRAN
Tool
uses
from Line Dancer
Malware
uses
from LoJax
Malware
uses
from MEDUSA
Malware
uses
from PoisonIvy
Malware
uses
from Ramsay
Malware
uses
from RedPenguin
Campaign
uses
from REPTILE
Malware
uses
from Rocke
Group
uses
from Skidmap
Malware
uses
from Stuxnet
Malware
uses
from TeamTNT
Group
uses
from Umbreon
Malware
uses
from UNC3886
Group
uses
from Uroburos
Malware
uses
from WarzoneRAT
Malware
uses
from Winnti for Linux
Malware
uses
from Winnti Group
Group
uses
from Zeroaccess
Malware
5 external

References

mitre-attack
T1014
open
CrowdStrike Linux Rootkit
https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/
open
BlackHat Mac OSX Rootkit
http://www.blackhat.com/docs/asia-14/materials/Tsai/WP-Asia-14-Tsai-You-Cant-See-Me-A-Mac-OS-X-Rootkit-Uses-The-Tricks-You-Havent-Known-Yet.pdf
open
Symantec Windows Rootkits
https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf
open
Wikipedia Rootkit
https://en.wikipedia.org/wiki/Rootkit
open
Continue into the dataIntelligence explorerHow to read the graphEvidence & provenance