Rootkits and bootkits hide malware from the operating system and the security tools that rely on it, so the usual signals of compromise never appear. This hub catalogues the 14 software entries that NHI Mgmt Group groups as rootkits and bootkits in MITRE ATT&CK Enterprise v20, from kernel-mode Windows drivers to Linux loadable kernel modules, UEFI firmware implants and boot sector bootkits. It summarises the behaviours the family shares, computed from the ATT&CK v20 technique relationships, then turns them into detection, hardening and response priorities. It is written for detection engineers, incident responders and platform owners who need one place to see which families matter for which platforms. For the concepts behind the techniques, see the Rootkits and Bootkits Guide; this page is the catalogue view.
Key takeaways
- Small family, outsized impact: 14 ATT&CK v20 entries, all malware, but they include firmware and boot implants that survive disk replacement and operating system reinstalls.
- Stealth is the shared trait: T1014 Rootkit is mapped to 10 of the 14 members, and T1564 Hide Artifacts and T1542 Pre-OS Boot to 4 each, so detection has to look from outside the compromised layer.
- Linux and hypervisor estates are in scope: REPTILE, MEDUSA, Umbreon and Skidmap target Linux, and Mandiant reports UNC3886 deploying REPTILE and MEDUSA on guest machines reached through compromised vCenter and ESXi.
- Boot integrity is a control, not a setting: Secure Boot with a current revocation list (DBX), memory integrity and the vulnerable driver blocklist remove most of the paths these families use, but only when they are on and kept current.
- Credentials leak below the surface: MEDUSA logs credentials from local and remote logins, so a rootkit finding means rotating every credential and key that touched the host, including service accounts and SSH keys.
What this category covers and why it matters
ATT&CK models rootkits as T1014 Rootkit and boot or firmware persistence as T1542 Pre-OS Boot, with sub-techniques such as T1542.001 System Firmware and T1542.003 Bootkit. The software in this hub is the set of ATT&CK v20 entries whose primary purpose is to run below or alongside the kernel and hide other activity. Membership is an NHI Mgmt Group grouping of ATT&CK software, not an official MITRE category, and each entry links to its ATT&CK page.
The category matters for three reasons. First, these tools defeat the evidence most teams depend on: process lists, file listings, network connection tables and even endpoint agent telemetry are produced by the layer the rootkit controls. Second, firmware and boot implants persist through the standard recovery playbook of reimaging a host. ESET described LoJax, which it attributes to the group it calls Sednit (APT28), as a malicious UEFI module written to SPI flash that survives operating system reinstallation and hard disk replacement. Third, rootkits are usually the last stage of an intrusion, so finding one means the adversary already had administrative or kernel level access.
| Layer | Hub members | What survives a reimage | Primary defensive control |
|---|---|---|---|
| Firmware (UEFI, SPI flash) | LoJax, Hacking Team UEFI Rootkit | Yes, until firmware is reflashed | Firmware updates, platform write protection, hardware root of trust, SI-7.10 |
| Boot sector or boot manager | ROCKBOOT, BOOTRASH | Often, if the boot record is not rebuilt | Secure Boot with current DBX, measured boot, SI-7.9 |
| Windows kernel driver | HIDEDRV, Pandora, Zeroaccess, Hikit, Linfo, Stuxnet | No, but the driver can be redeployed | Driver signing policy, memory integrity, vulnerable driver blocklist |
| Linux kernel module or user land hooking | REPTILE, MEDUSA, Umbreon, Skidmap | No, but persistence scripts reload it | Module signing and lockdown, integrity monitoring of preload and startup files |
Common behaviours across the family
The table counts how many hub members ATT&CK v20 maps to each technique (sub-techniques rolled up to their parent). It shows what the family does once installed, which is where cross-family detection pays off.
| Technique (ATT&CK v20) | Tactic | Members using it |
|---|---|---|
| T1014 Rootkit | Stealth | 10 of 14 |
| T1059 Command and Scripting Interpreter | Execution | 5 of 14 |
| T1542 Pre-OS Boot | Stealth, Persistence | 4 of 14 |
| T1564 Hide Artifacts | Stealth | 4 of 14 |
| T1573 Encrypted Channel | Command and Control | 4 of 14 |
| T1105 Ingress Tool Transfer | Command and Control | 4 of 14 |
| T1027 Obfuscated Files or Information | Stealth | 4 of 14 |
| T1055 Process Injection | Stealth, Privilege Escalation | 3 of 14 |
| T1071 Application Layer Protocol | Command and Control | 3 of 14 |
| T1553 Subvert Trust Controls | Defense Impairment | 3 of 14 |
| T1574 Hijack Execution Flow | Stealth, Execution | 3 of 14 |
| T1083 File and Directory Discovery | Discovery | 3 of 14 |
| T1082 System Information Discovery | Discovery | 3 of 14 |
| T1057 Process Discovery | Discovery | 3 of 14 |
- Hiding first: T1014 and T1564 cover hiding files, processes, registry keys and network connections. Mandiant reports that REPTILE's user-mode component hides files, processes and connections on Linux hosts.
- Waking on a signal: T1205 Traffic Signaling appears on several members. Mandiant describes REPTILE listening for a specialised TCP, UDP or ICMP packet before it activates (T1205.001 Port Knocking), so there is no open listening port to scan for.
- Hijacking the loader: MEDUSA hijacks the Linux dynamic linker through LD_PRELOAD (T1574.006 Dynamic Linker Hijacking), and Mandiant reports that UNC3886 modified PAM functions in it to always return success and stop reporting SSH information.
- Carrying a payload: most members also map to C2 and ingress techniques (T1071, T1573, T1105), because the rootkit exists to protect a backdoor. Treat a rootkit as a symptom of a wider implant set.
Real cases that shaped the defences
- LoJax (APT28, 2018): ESET reported trojanised samples of a legitimate laptop recovery agent pointed at attacker servers, with a signed kernel driver from a hardware utility used to read and write firmware. ESET's later update noted that Secure Boot did not protect against this rootkit, and its recommended remediation was reflashing the SPI flash with a clean image or replacing the motherboard. See the APT28 (Fancy Bear) Threat Actor Profile.
- REPTILE and MEDUSA (UNC3886): Mandiant reports that UNC3886 gained control of Linux guest machines on ESXi hosts managed by a compromised vCenter, used REPTILE as a small first foothold, and used MEDUSA to log credentials from successful authentications for lateral movement. A customised REPTILE listener used a victim's legitimate TLS certificate and private key taken from compromised FortiGate devices, and the actor pinned backdoored OpenSSH packages with yum versionlock so upgrades would not remove them. See the UNC3886 Threat Actor Profile Guide.
- BlackLotus and CVE-2023-24932: not an ATT&CK v20 hub entry, but the clearest recent bootkit lesson. Microsoft's KB5025885 describes the Secure Boot bypass used by the BlackLotus UEFI bootkit and a staged mitigation: add the Windows UEFI CA 2023 certificate to the Secure Boot DB, update the boot manager, revoke the Windows Production PCA 2011 certificate in the DBX and optionally apply the Secure Version Number update. Microsoft states the revocation cannot be reverted while Secure Boot stays on, and that the enforcement phase date had not been announced. See the Secure Boot Certificate Expiry 2026 guide for the certificate timeline.
- Pandora (Threat Group-3390): ATT&CK describes Pandora as a multistage kernel rootkit with backdoor functionality in use since at least 2020, which is a reminder that Windows driver rootkits remain an espionage tool. See the APT27 Threat Actor Profile Guide.
Detection themes
Because the compromised layer lies to the tools running on it, every detection theme below compares two views or measures from a lower layer.
| Theme | What to collect | Families it targets |
|---|---|---|
| Driver and module load monitoring | Windows System log Event ID 7045 (service installed, including kernel drivers), Sysmon Event ID 6 (driver loaded), Code Integrity operational log for blocked or audited drivers; Linux kernel module load events from auditd init_module and finit_module syscalls | HIDEDRV, Pandora, Zeroaccess, REPTILE |
| Boot and firmware integrity | Measured boot logs and TPM attestation results, Secure Boot state, firmware version inventory, changes to the EFI system partition | LoJax, ROCKBOOT, BOOTRASH, Hacking Team UEFI Rootkit |
| Cross-view comparison | Network flow from switches or cloud flow logs compared with host connection tables; offline disk scans compared with live file listings; memory captures analysed off host | All hiding families |
| Linker and authentication tampering | Changes to /etc/ld.so.preload and LD_PRELOAD in service environments, PAM module and configuration changes, unexpected package version locks | MEDUSA |
| Traffic signalling | Unusual single packets to closed ports followed by outbound sessions, ICMP with payloads, TLS sessions using certificates belonging to other devices | REPTILE and other passive implants |
For the full method on ESXi and vCenter evidence, see the VMware ESXi Forensics guide, and for kernel drivers abused to kill security tools see the Bring Your Own Vulnerable Driver and EDR Killers Guide.
Hardening that removes the paths
- Windows driver control: Microsoft documents that the vulnerable driver blocklist has been on by default since the Windows 11 2022 update and is also enforced when memory integrity (hypervisor-protected code integrity), Smart App Control or S mode is active. It is updated quarterly and ships in monthly updates; organisations wanting the newest list can deploy it as an App Control for Business policy, tested in audit mode first.
- Secure Boot and revocations: keep Secure Boot on, track DBX updates and plan the KB5025885 steps, including updating recovery and install media before revocation.
- Firmware: keep UEFI firmware current, turn on platform write protections and hardware root of trust features the platform offers, and record firmware versions in the asset inventory so outliers are visible.
- Linux: require signed kernel modules, use kernel lockdown where supported, and baseline startup scripts, systemd units and preload files with file integrity monitoring. See the Linux Secure Boot and Shim Guide.
- Hypervisors: restrict who can reach vCenter and ESXi management, and harden hosts as described in the VMware ESXi Hardening Guide.
Where identity fits
Rootkits sit where credentials pass through. MEDUSA's credential logging and REPTILE's use of a stolen device certificate and private key show that a kernel compromise is also a credential compromise. When a rootkit is confirmed, treat every secret the host held or saw as exposed: service account passwords, SSH host and user keys, TLS private keys, API tokens in configuration files and cloud instance credentials. Rotate them from a clean system and watch for their use from other hosts afterwards, using the approach in the MITRE ATT&CK T1552 Unsecured Credentials Guide.
How to put this hub to work
- Map platforms to members: use the platform column in the catalogue below to list which families apply to your Windows, Linux and virtualisation estate.
- Turn on the preventive baseline in audit first: run App Control driver policies and module signing enforcement in audit mode on a pilot ring, review blocked loads, then enforce. Keep a documented rollback (policy removal or previous kernel) for each ring.
- Stand up lower-layer telemetry: collect driver and module load events, Secure Boot and measured boot state, and network flow from outside the host.
- Write cross-view analytics: alert when hosts show outbound sessions in flow data that the endpoint agent does not report, and when preload, PAM or boot partition files change outside change windows.
- Rehearse response: agree in advance when to reimage, when to reflash firmware and when to replace hardware, and include credential rotation in the plan. The Firmware and Bootkit Compromise Playbook sets out the steps.
Measuring coverage
- Percentage of Windows endpoints and servers with memory integrity on and the vulnerable driver blocklist enforced.
- Percentage of devices with Secure Boot on and the current DBX applied, by hardware model.
- Percentage of Linux hosts enforcing module signature verification.
- Number of hosts where flow data and endpoint connection data disagree, reviewed each week.
- Time from a rootkit finding to rotation of all credentials the host held.
Framework mapping
| Framework | Reference | Relevance to this family |
|---|---|---|
| ATT&CK v20 | T1014 Rootkit, T1542 Pre-OS Boot (T1542.001, T1542.003), T1564 Hide Artifacts, T1574.006, T1205.001 | The techniques that define the family |
| NIST SP 800-53 Rev 5 | SI-7 Software, Firmware, and Information Integrity; SI-7.9 Verify Boot Process; SI-7.10 Protection of Boot Firmware; CM-14 Signed Components; SI-4 System Monitoring | Integrity verification of boot, firmware and kernel components |
| NIST CSF 2.0 | PR.PS-05, DE.CM-09, RS.AN-03 | Preventing unauthorised software, monitoring runtime environments, root cause analysis |
| CIS Controls v8.1 | Control 2 Inventory and Control of Software Assets; Control 10 Malware Defenses | Allowlisting and anti-malware coverage |
| ISO/IEC 27001:2022 Annex A | A.8.7 Protection against malware; A.8.16 Monitoring activities | Malware controls and monitoring |
Common failure patterns
- Trusting the infected host's view: clearing an alert because the endpoint agent shows no matching process or connection, when the rootkit controls what the agent sees.
- Reimaging without checking firmware: rebuilding a host compromised by a firmware implant and returning it to service with the implant intact.
- Blocklists left in audit forever: driver policies deployed in audit mode for a pilot and never moved to enforcement.
- Revocations without media updates: applying Secure Boot revocations and then discovering recovery media no longer boots during an incident.
- Ignoring the hypervisor layer: hunting only inside guests while the access path runs through vCenter and ESXi management.
- Forgetting the credentials: cleaning the host but leaving service account passwords, SSH keys and certificates it handled unchanged.
Complete catalogue: rootkits and bootkits in ATT&CK v20
All 14 entries (14 malware, 0 tools), sorted by name. Groups are those ATT&CK v20 links to the software; distinctive techniques are the member's mapped techniques that are least common across this hub. Each ID links to its ATT&CK page.
| ID | Name | Type | Platforms | Associated groups (v20) | Distinctive techniques |
|---|---|---|---|---|---|
| S0114 | BOOTRASH | Malware | Windows | No group linked in v20 | T1542 Pre-OS Boot, T1564 Hide Artifacts |
| S0047 | Hacking Team UEFI Rootkit | Malware | Not stated | No group linked in v20 | T1542 Pre-OS Boot, T1014 Rootkit |
| S0135 | HIDEDRV | Malware | Windows | APT28 | T1055 Process Injection, T1014 Rootkit |
| S0009 | Hikit | Malware | Windows | Axiom | T1566 Phishing, T1005 Data from Local System, T1090 Proxy |
| S0211 | Linfo | Malware | Windows | Elderwood | T1029 Scheduled Transfer, T1005 Data from Local System, T1008 Fallback Channels |
| S0397 | LoJax | Malware | Windows | APT28 | T1112 Modify Registry, T1547 Boot or Logon Autostart Execution, T1542 Pre-OS Boot |
| S1220 | MEDUSA | Malware | Linux | UNC3886 | T1563 Remote Service Session Hijacking, T1574 Hijack Execution Flow, T1027 Obfuscated Files or Information |
| S0664 | Pandora | Malware | Windows | Cinnamon Tempest, Threat Group-3390 | T1569 System Services, T1068 Exploitation for Privilege Escalation, T1055 Process Injection |
| S1219 | REPTILE | Malware | Linux | UNC3886 | T1546 Event Triggered Execution, T1095 Non-Application Layer Protocol, T1140 Deobfuscate/Decode Files or Information |
| S0112 | ROCKBOOT | Malware | Windows | APT41 | T1542 Pre-OS Boot |
| S0468 | Skidmap | Malware | Linux | No group linked in v20 | T1036 Masquerading, T1098 Account Manipulation, T1496 Resource Hijacking |
| S0603 | Stuxnet | Malware | Windows | No group linked in v20 | T1012 Query Registry, T1016 System Network Configuration Discovery, T1021 Remote Services |
| S0221 | Umbreon | Malware | Linux | No group linked in v20 | T1078 Valid Accounts, T1095 Non-Application Layer Protocol, T1205 Traffic Signaling |
| S0027 | Zeroaccess | Malware | Not stated | No group linked in v20 | T1564 Hide Artifacts, T1014 Rootkit |
Related software hubs: ATT&CK Espionage Backdoors and Implants Software Hub for the backdoors that rootkits usually protect, and ATT&CK C2 and Post-Exploitation Frameworks Software Hub.
Practitioner checklist
- Map each family in the catalogue to the platforms you run and record which controls cover it.
- Enforce memory integrity and the vulnerable driver blocklist on Windows, after an audit mode pilot.
- Keep Secure Boot on, track DBX and KB5025885 steps, and update recovery media before revocation.
- Require signed kernel modules on Linux and monitor preload, PAM and startup file changes.
- Collect network flow from outside hosts and alert on disagreement with endpoint telemetry.
- Inventory firmware versions and include firmware reflash or hardware replacement in response plans.
- Rotate every credential, key and certificate a compromised host held, from a clean system.
- Restrict and monitor vCenter and ESXi management access.
Standards and references
- MITRE ATT&CK: T1014 Rootkit
- MITRE ATT&CK: T1542 Pre-OS Boot
- Microsoft: KB5025885 How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932
- Microsoft Learn: Microsoft recommended driver block rules
- NSA: NSA Releases Guide to Mitigate BlackLotus Threat
- Google Cloud (Mandiant): Uncovering UNC3886 espionage operations
- ESET: LoJax, first UEFI rootkit found in the wild
- NIST: SP 800-53 Rev 5 Security and Privacy Controls
Related NHI Mgmt Group resources: Rootkits and Bootkits Guide · MITRE ATT&CK T1014 Rootkit · MITRE ATT&CK T1542 Pre-OS Boot · Firmware and Bootkit Compromise Playbook