Threat intelligence / Mitigation
Rootkit Mitigation
Identify potentially malicious software that may contain rootkit functionality, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
Mitigation
TypeMitigation
External ID—
First seen2026-08-14
Last seen2026-08-14
Confidence
—
Identify potentially malicious software that may contain rootkit functionality, and audit and/or block it by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)
0 recorded
Relationships
No relationships recorded.
6 external
References
Beechey 2010
http://www.sans.org/reading-room/whitepapers/application/application-whitelisting-panacea-propaganda-33599
openWindows Commands JPCERT
https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
openNSA MS AppLocker
https://apps.nsa.gov/iaarchive/library/ia-guidance/tech-briefs/application-whitelisting-using-microsoft-applocker.cfm
open