Potential rootkit compiled and then loaded

Classification:

attack

Tactic:

TA0004-privilege-escalation

Technique:

T1574-hijack-execution-flow

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect malicious user or kernel modules being compiled and then loaded.

Strategy

Attackers will attempt to use kernel or user mode rootkits for various purposes, to include privilege escalation, code execution, or defense evasion. Typically, the actors will have to first compile the module, and then load it with a dynamic linker or by loading the object directly.