T1014Stealth
Rootkit
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.2
Reports1
Detections
1 Sigma rule tagged T1014RootkitT10141 general rule
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Rootkit
2 CVEs, by priority. Each link shows its badge.- CVE-2018-19323GIGABYTE Multiple Products Privilege Escalation VulnerabilityGIGABYTE · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1068Exploitation for Privilege EscalationT1014RootkitAI mapping from the description · primary impact8.4%Top 5%78.9priority
- CVE-2018-19320GIGABYTE Multiple Products Unspecified VulnerabilityGIGABYTE · Multiple ProductsKEVRansomwarePublic exploitHigh · 7.8T1068Exploitation for Privilege EscalationT1014RootkitAI mapping from the description · primary impact4.6%Top 8.4%76.8priority