CAPEC-552: Install Rootkit
Description
An adversary exploits a weakness in authentication to install malware that alters the functionality and information provide by targeted operating system API calls. Often referred to as rootkits, it is often used to hide the presence of programs, files, network connections, services, drivers, and other system components.
- Likelihood of attack
- Medium
- Typical severity
- High
- Abstraction
- DetailedA low-level, detailed pattern, often for a particular technology.
Mechanism of attack: Inject Unexpected Items
Mitigations
- Prevent adversary access to privileged accounts necessary to install rootkits.
Related weaknesses (CWE)
ATT&CK techniques (CAPEC taxonomy mapping)
- T1014Rootkit
- T1542.003Pre-OS Boot: Bootkit
- T1547.006Boot or Logon Autostart Execution: Kernel Modules and Extensions
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 3 ATT&CK techniques above.
Counter with D3FEND
Defensive techniques MITRE D3FEND maps to the same ATT&CK techniques.
- D3-AVEAsset Vulnerability Enumeration3 shared
- D3-RSRestore Software3 shared
- D3-SWISoftware Inventory3 shared
- D3-SUSoftware Update3 shared
- D3-FBAFirmware Behavior Analysis2 shared
- D3-FEMCFirmware Embedded Monitoring Code2 shared
- D3-FVFirmware Verification2 shared
- D3-CFContent Filtering2 shared
- D3-CMContent Modification2 shared
- D3-DFDecoy File2 shared
- D3-FAFile Analysis2 shared
- D3-FEFile Encryption2 shared
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.
- CAR-2021-11-002Registry Edit with Modification of Userinit, Shell or Notify1 shared
- CAR-2021-12-002Modification of Default Startup Folder in the Registry Key 'Common Startup'1 shared
- CAR-2013-03-001Reg.exe called from Command Shell1 shared
- CAR-2020-05-003Rare LolBAS Command Lines1 shared
- CAR-2013-01-002Autorun Differences1 shared