mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
21 lines
1.3 KiB
YAML
21 lines
1.3 KiB
YAML
name: Linux Rootkit
|
|
id: e30f4054-ac08-4999-b8bc-5cc46886c18d
|
|
version: 2
|
|
creation_date: '2022-07-27'
|
|
modification_date: '2026-05-13'
|
|
author: Michael Haag, Splunk
|
|
status: production
|
|
description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
|
|
narrative: Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems. Linux rootkits may not standout as much as a Windows rootkit, therefore understanding what kernel modules are installed today and monitoring for new is important. As with any rootkit, it may blend in using a common kernel name or variation of legitimate names.
|
|
references:
|
|
- https://attack.mitre.org/techniques/T1014/
|
|
- https://content.fireeye.com/apt-41/rpt-apt41
|
|
- https://medium.com/chronicle-blog/winnti-more-than-just-windows-and-gates-e4f03436031a
|
|
category:
|
|
- Adversary Tactics
|
|
product:
|
|
- Splunk Enterprise
|
|
- Splunk Enterprise Security
|
|
- Splunk Cloud
|
|
usecase: Advanced Threat Detection
|