Rootkit Deployment

Overview

Rootkit deployment is a technique used by adversaries to maintain stealthy and persistent control over a compromised system by installing software that hides its presence and activities. It plays a critical role in the persistence and defense evasion stages of the attack lifecycle, enabling attackers to operate undetected for extended periods.

Attack Objective

• Establish stealthy persistence and maintain privileged access
• Supports persistence, defense evasion, and privilege escalation stages
• Advances attacker position by concealing malicious processes, files, and network connections to avoid detection and removal

How the Technique Works

Rootkits operate by modifying system components such as kernel modules, system libraries, or firmware to intercept and alter operating system functions. This manipulation allows the rootkit to hide files, processes, registry keys, and network activity associated with the attacker’s presence, effectively masking malicious behavior from security tools and system administrators.

Common Methods & Variations

• Kernel-mode rootkits that modify or replace kernel code or drivers
• User-mode rootkits that hook system APIs or replace system binaries
• Bootkits that infect the bootloader or firmware to gain control before the OS loads
• Variants targeting on-premises endpoints, cloud instances, or embedded devices
• Use of living-off-the-land techniques by leveraging legitimate system tools alongside or instead of custom rootkit components

Indicators of Compromise (IOCs)

• Unexpected system module or driver loads, especially unsigned or anomalous ones
• Discrepancies between system process listings and network connections
• Unexplained modifications to system binaries or boot components
• Unusual kernel or system call behavior detected via monitoring tools
• Persistence artifacts such as hidden services or scheduled tasks linked to rootkit components

Detection Strategies

• Telemetry from kernel event tracing, system integrity monitoring, and endpoint detection and response (EDR) solutions
• Behavioral detection focusing on anomalies in system calls, driver loads, and process enumeration
• Signature-based detection for known rootkit components and suspicious file hashes
• Correlation of endpoint, network, and system logs to identify inconsistencies indicative of rootkit activity

Mitigation & Prevention

• Enforce code signing and integrity verification for kernel modules and drivers
• Implement least privilege principles to limit ability to install or modify system components
• Regularly update and patch operating systems and firmware to close vulnerabilities exploited by rootkits
• Deploy endpoint protection solutions with rootkit detection capabilities
• Use secure boot and trusted platform modules (TPM) to prevent unauthorized bootloader or firmware modifications

Response Considerations

• Immediate containment by isolating affected systems to prevent further compromise
• Comprehensive investigation including memory analysis and forensic examination of system components
• System reimaging or restoration from known-good backups due to difficulty in fully removing rootkits
• Post-incident hardening including enhanced monitoring, patching, and review of privilege assignments

Related Techniques

• Privilege Escalation via kernel exploits or credential dumping
• Persistence through scheduled tasks, services, or bootkits
• Defense Evasion by disabling security tools or tampering with logs
• Lateral Movement using compromised credentials or remote execution

Mapping & References

• MITRE ATT&CK TTPs: Persistence (T1547), Defense Evasion (T1215), Privilege Escalation (T1068)
• Public research on rootkit detection and mitigation from cybersecurity vendors and academic sources
• Incident reports documenting rootkit use in targeted attacks and advanced persistent threats (APTs)