166 terms · 75/46/45
Technique № 017 · class: execution

Rootkit Installation

Technique of installing a rootkit to deeply hide presence on a system.

Term

description · examples · notes

Technique of installing a rootkit to deeply hide presence on a system.

Description

Can operate at user-space, kernel, or firmware (UEFI) level.

Kernel rootkits modify system calls to hide files and processes.

UEFI rootkits survive operating system reinstallation.

Requires previously obtained administrative or kernel privileges.

Examples

  • LoJax UEFI rootkit found in APT28 operations
  • Necurs rootkit for hiding botnet components

Notes

  • Technique (how it is installed) for the rootkit threat.
tags
rootkit kernel firmware persistence
◳Composite

Threats

used by 2

Threats that use it. Select one to open its page.

Defenses

countered by 4

How it is countered. Select one to open its page.