T1014

Official Description

Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits)

Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit)

Rootkits that reside or modify boot sectors are known as [Bootkit](https://attack.mitre.org/techniques/T1542/003)s and specifically target the boot process of the operating system.

Tactics: Stealth
Platforms: Linux, macOS, Windows
MITRE Version: 2.0
Last Modified: May 12, 2026

View on MITRE ATT&CK ↗

Reported Context (36)

The bootkit protected its files by intercepting user requests to open them and launching Windows Calculator instead. BlackX UEFI Bootkit Exploits Baton Drop to Bypass Secure Boot
The libprocesshider-based user-mode rootkit hooked readdir() to hide selected processes from conventional administrative utilities. WatchGuard H1 2026 Report Finds More Novel Malware Despite Falling Network Detections
Public reporting describes deployment of an updated FudModule rootkit in Lazarus Group activity. CYFIRMA Q3 2026 Report Tracks 48 APT Campaigns, Persistent Backdoors and Edge-Device Exploitation
Lazarus deployed a Windows rootkit on victims' systems after exploiting a historical Dell dbutil driver vulnerability. Critical Dell System Update flaw lets remote attackers gain root access
The bundled hmn_hook.dll hooks NtQuerySystemInformation to filter a specified process name from returned results; deployment was not confirmed. AvisLoader Windows Malware Uses Tox P2P for Command-and-Control

CVE (37)

Malware (95)

People (13)

Threat Actors (43)

MITRE ATT&CK (155)

Vendors (35)

Products (120)

Tools (65)

Industries (37)

Countries (40)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.