Potential rootkit compiled and then loaded

Classification:

attack

Tactic:

TA0004-privilege-escalation

Technique:

T1574-hijack-execution-flow

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect malicious user or kernel modules being compiled and then loaded.

Strategy

Attackers will attempt to use kernel or user mode rootkits for various purposes, to include privilege escalation, code execution, or defense evasion. Typically, the actors will have to first compile the module, and then load it with a dynamic linker or by loading the object directly.