# T1014 - Rootkit
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1014)
<blockquote>Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. (Citation: Symantec Windows Rootkits) 

Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or [System Firmware](https://attack.mitre.org/techniques/T1542/001). (Citation: Wikipedia Rootkit) Rootkits have been seen for Windows, Linux, and Mac OS X systems. (Citation: CrowdStrike Linux Rootkit) (Citation: BlackHat Mac OSX Rootkit)</blockquote>

## Atomic Tests

- [Atomic Test #1 - Loadable Kernel Module based Rootkit](#atomic-test-1---loadable-kernel-module-based-rootkit)

- [Atomic Test #2 - Loadable Kernel Module based Rootkit](#atomic-test-2---loadable-kernel-module-based-rootkit)


<br/>

## Atomic Test #1 - Loadable Kernel Module based Rootkit
Loadable Kernel Module based Rootkit

**Supported Platforms:** Linux


**auto_generated_guid:** dfb50072-e45a-4c75-a17e-a484809c8553





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| rootkit_source_path | Path to the rootkit source. Used when prerequistes are fetched. | Path | PathToAtomicsFolder/T1014/src/Linux|
| rootkit_path | Path To rootkit | String | PathToAtomicsFolder/T1014/bin/T1014.ko|
| rootkit_name | Module name | String | T1014|
| temp_folder | Temp folder used to compile the code. Used when prerequistes are fetched. | Path | /tmp/T1014|


#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo insmod #{rootkit_path}
```

#### Cleanup Commands:
```sh
sudo rmmod #{rootkit_name}
```



#### Dependencies:  Run with `bash`!
##### Description: The kernel module must exist on disk at specified location (#{rootkit_path})
##### Check Prereq Commands:
```bash
if [ -f #{rootkit_path} ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```bash
if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
cp #{rootkit_source_path}/* #{temp_folder}/
cd #{temp_folder}; make
mv #{temp_folder}/#{rootkit_name}.ko #{rootkit_path}
[ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
```




<br/>
<br/>

## Atomic Test #2 - Loadable Kernel Module based Rootkit
Loadable Kernel Module based Rootkit

**Supported Platforms:** Linux


**auto_generated_guid:** 75483ef8-f10f-444a-bf02-62eb0e48db6f





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| rootkit_source_path | Path to the rootkit source. Used when prerequistes are fetched. | Path | PathToAtomicsFolder/T1014/src/Linux|
| rootkit_path | Path To rootkit | String | PathToAtomicsFolder/T1014/bin/T1014.ko|
| rootkit_name | Module name | String | T1014|
| temp_folder | Temp folder used to compile the code. Used when prerequistes are fetched. | Path | /tmp/T1014|


#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo modprobe #{rootkit_name}
```

#### Cleanup Commands:
```sh
sudo modprobe -r #{rootkit_name}
sudo rm /lib/modules/$(uname -r)/#{rootkit_name}.ko
sudo depmod -a
```



#### Dependencies:  Run with `bash`!
##### Description: The kernel module must exist on disk at specified location (#{rootkit_path})
##### Check Prereq Commands:
```bash
if [ -f /lib/modules/$(uname -r)/#{rootkit_name}.ko ]; then exit 0; else exit 1; fi;
```
##### Get Prereq Commands:
```bash
if [ ! -d #{temp_folder} ]; then mkdir #{temp_folder}; touch #{temp_folder}/safe_to_delete; fi;
cp #{rootkit_source_path}/* #{temp_folder}/
cd #{temp_folder}; make        
sudo cp #{temp_folder}/#{rootkit_name}.ko /lib/modules/$(uname -r)/
[ -f #{temp_folder}/safe_to_delete ] && rm -rf #{temp_folder}
sudo depmod -a
```




<br/>
