Sınıf: Rootkit
Bu tür kötü amaçlı program, sistemdeki belirli nesneleri veya etkinlikleri gizlemek için tasarlanmıştır. Kayıtlı anahtarlar (örneğin, kötü amaçlı nesnelerin otomatik olarak başlatılması için kullanılan), virüs bulaşmış bir bilgisayarın belleğindeki dosyalar, klasörler ve işlemlerin yanı sıra kötü amaçlı ağ etkinliği de gizlenebilir. Rootkit'lerin kendileri herhangi bir kötü amaçlı yüke sahiptir, ancak çoğu durumda, bu tür programlar kötü amaçlı programların algılanmasını önlemek ve virüslü bir bilgisayarda çalıştıkları süreyi uzatmak için kullanılır.Platform: Win64
Win64, 32/64-bit uygulamaların yürütülmesi için Windows tabanlı işletim sistemlerinde bir platformdur. Win64 programları, Windows'un 32 bit sürümlerinde başlatılamaz.Aile: Rootkit.Win64.Agent
No family descriptionExamples
22F11F843A38131FC76FBA5A1AECA66ATactics and Techniques: Mitre*
TA0003
Persistence
The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.
T1543.003
Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
TA0004
Privilege Escalation
The adversary is trying to gain higher-level permissions. Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. Adversaries can often enter and explore a network with unprivileged access but require elevated permissions to follow through on their objectives. Common approaches are to take advantage of system weaknesses, misconfigurations, and vulnerabilities. Examples of elevated access include: SYSTEM/root level, local administrator, user account with admin-like access, user accounts with access to specific system or perform specific function. These techniques often overlap with Persistence techniques, as OS features that let an adversary persist can execute in an elevated context.
T1543.003
Windows Service
Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions. Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
* © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.