Rootkit
Technique · ATTACK:enterprise:T1014
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1014",
"title": "Rootkit",
"type": "Technique",
"source_url": "https://attack.mitre.org/techniques/T1014",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--0f20e3cb-245b-4a61-8a91-2d93f7cb0e9b",
"external_id": "T1014",
"domain": "enterprise",
"created": "2017-05-31T21:30:26.496Z",
"modified": "2026-05-12T15:12:00.620Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "CrowdStrike Linux Rootkit",
"url": "https://www.crowdstrike.com/blog/http-iframe-injecting-linux-rootkit/"
},
{
"source_name": "BlackHat Mac OSX Rootkit",
"url": "http://www.blackhat.com/docs/asia-14/materials/Tsai/WP-Asia-14-Tsai-You-Cant-See-Me-A-Mac-OS-X-Rootkit-Uses-The-Tricks-You-Havent-Known-Yet.pdf"
},
{
"source_name": "Symantec Windows Rootkits",
"url": "https://www.symantec.com/avcenter/reference/windows.rootkit.overview.pdf"
},
{
"source_name": "Wikipedia Rootkit",
"url": "https://en.wikipedia.org/wiki/Rootkit"
}
]
}Explicit source assertions (33)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0377 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05a3d203-4b38-4f38-a015-dcfe3bdf9c07
ESET Ebury May 2024 · ESET Ebury Oct 2017ATTACK:enterprise:G0044 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--05e05236-1635-48d7-8ee3-33319c01c815
Kaspersky Winnti April 2013ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1be07717-ad08-4364-9a58-b44a95a389a5
Crowdstrike GTR2020 Mar 2020 · FireEye APT41 Aug 2019ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2107aab0-0191-46d1-abec-8d98ac916c21
Anomali Rocke March 2019ATTACK:enterprise:S0484 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21b929b8-8fec-47a5-8f98-554a043f9de5
Prevx Carberp March 2011ATTACK:enterprise:S0458 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2962304a-f96e-4323-958f-f685eae97ac6
Eset Ramsay May 2020ATTACK:enterprise:S0502 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3da780a6-2bd0-47ce-b434-fe513abb7ee5
NSA/FBI Drovorub August 2020ATTACK:enterprise:S0040 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4b14d96b-1664-4072-a49a-3a990a13ca83
NCSC Joint Report Public ToolsATTACK:enterprise:S0135 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69b9edd8-c1a8-4cbd-bd94-9af0fdefe013
ESET Sednit Part 3ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b8a8055-5b1c-4e06-a6ef-4a42e23e2e11
Cisco Talos Intelligence Group · Trend Micro TeamTNTATTACK:enterprise:S0468 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--759185fe-d576-43f5-afac-acd653e5fcf4
Trend Micro SkidmapATTACK:enterprise:S0221 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7653431a-18ac-43da-8308-63c76ecf0c22
Umbreon Trend MicroATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c85cd06-5b92-4b5d-acf5-fdd12a73b289
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:enterprise:S1105 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8162c91d-b82d-4e19-9fac-5a7191e4aa17
NCSC-NL COATHANGER Feb 2024ATTACK:enterprise:S0047 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89433640-bf49-48b3-9f26-76423cd36f77
TrendMicro Hacking Team UEFIATTACK:enterprise:S0394 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8a8e30e6-c226-4739-87de-bd98c104d211
Intezer HiddenWasp Map 2019ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8f5fdbbc-73b1-48a6-9916-67c0baa0f66e
Unit 42 Hildegard MalwareATTACK:enterprise:S1186 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95283b95-4474-47ac-9e77-a1f4da968f9f
Cisco ArcaneDoor 2024ATTACK:enterprise:C0046 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f9d3b11-4b0e-4e56-b19f-62e80ce0ada9
Cisco ArcaneDoor 2024ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a5022441-bc5e-4b19-a773-b96b2719d1bb
Symantec APT28 Oct 2018 · ESET LoJax Sept 2018ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aacb43b8-2d3a-40bc-9f7b-1acb5b2474f2
FireEye Hikit Rootkit · FireEye HIKIT Rootkit Part 2ATTACK:enterprise:S1220 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--add8d076-83a4-44cf-8e4c-90caa144e488
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:S1219 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--af3233ba-82e8-49d1-bce7-2b96aced774d
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b3c11e91-229d-4624-bf0c-2178c780c5cd
Google Cloud Mandiant UNC3886 2024ATTACK:enterprise:S0430 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c85d86c0-8adc-42fc-b7c9-8ca33d9ac4b6
Chronicle Winnti for Linux May 2019ATTACK:enterprise:S0027 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--da6aa745-9eb5-44d9-80f8-e9f542d106d2
Sophos ZeroAccessATTACK:enterprise:S0397 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e9f52758-d5aa-4a16-b614-ea756a0cf270
ESET LoJax Sept 2018ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb74fa31-121d-4e43-9794-048a901f509a
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023 · Kaspersky TurlaATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eeb368b7-52b9-4320-a34f-8f3235beb22f
Check Point Warzone Feb 2020ATTACK:enterprise:S0572 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f16c71ae-99b1-4aff-b276-13eb7c3ad889
ClearSky Lebanese Cedar Jan 2021ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f665b656-c5ac-47b8-84f2-25ed6a182c44
AI-Mexico-Govt-BreachATTACK:enterprise:S0012 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8340d49-ee7a-4ade-988f-3660904a18bb
Symantec Darkmoon Aug 2005ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1014
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f9a7a71f-9b10-409d-9eb9-3768bd44b744
Mandiant UNC3886 Juniper Routers MAR 2025