Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Defense Evasion/ T1014

T1014Rootkit

T1014 — Rootkit is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 8 detection use cases covering it and 3 threat-intel articles citing it.

Defense Evasion
View on the matrix → Filter Detection Library MITRE official spec ↗
8Use cases
3Articles
0Sub-techniques
1Tactic

Use cases covering this technique (8)

Linux Auditd Kernel Module Enumeration ESCU actions · hunting P Linux Kernel Module Enumeration ESCU actions · hunting P Linux Medusa Rootkit ESCU actions · alerting P Windows Driver Load Non-Standard Path ESCU actions · alerting P Windows Drivers Loaded by Signature ESCU actions · hunting P [LLM] fast16 kernel driver (fast16.sys) drop / load — sabotage patching engine Bespoke install · alerting DSΣPDDCS [LLM] SprySOCKS WIN_DRV/WIN_PLUS backdoor binary by ESET SHA1 hash Bespoke install · hunting DSΣPDDCS [LLM] BYOVD: Genshin Impact mhyprot.sys driver dropped/loaded outside legitimate game install (Embargo evil-mhyprot-cli) Bespoke install · alerting DSΣP

Articles citing this technique (3)

high Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? art-117
med FishMonger’s arsenal upgraded: SprySOCKS for Windows art-328
crit EDR killers explained: Beyond the drivers art-577