{
  "family": "hideproc",
  "sample_count": 5,
  "category": "trojan",
  "description": "Rootkit:Win32/Hideproc (or generic process hiding tool) is a highly sophisticated, kernel-level rootkit component designed to completely conceal the presence of malicious processes, files, and network connections from the Windows operating system and its security tools. It acts as an invisibility cloak for other malware, allowing devastating payloads (like banking trojans or advanced RATs) to operate unseen by standard antivirus and EDR solutions.<br><br><b>Understanding Rootkits and Hideproc</b><br>To an end-user, a machine infected with Hideproc and its accompanying payload might run perfectly normally, or exhibit unexplained sluggishness. For a SOC analyst, a kernel rootkit is a worst-case scenario. It subverts the very foundation of trust on the endpoint. If the operating system's kernel is compromised, no information reported by the Task Manager, Registry Editor, or standard AV engine can be trusted.<br><br><b>Execution and Evasion Strategies</b><br>Hideproc typically requires the attacker to have already escalated privileges to SYSTEM (`T1548.002`), often using an exploit or a UAC bypass. Once elevated, the malware loads a malicious driver (`.sys` file) into the Windows kernel space (`T1014`). This driver uses techniques like Direct Kernel Object Manipulation (DKOM) or API Hooking (intercepting calls to `ZwQuerySystemInformation`) to filter the results returned to user-mode applications (`T1562.001`). When the Task Manager asks the kernel for a list of running processes, the Hideproc rootkit intercepts the request and removes the attacker's malicious process from the list before returning the data. The malicious process is running, but the OS cannot see it.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is deep, persistent, and entirely hidden compromise. Host-based IoCs are extremely difficult to find from within the live OS. They often require specialized rootkit scanners (like GMER), memory forensics, or offline analysis of the hard drive. EDR systems may detect the initial loading of the unsigned or maliciously signed kernel driver (`T1553.006`), but once loaded, the rootkit can blind the EDR. Network IoCs remain critical, as the rootkit cannot hide the actual packets leaving the machine on the wire.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1553.006",
    "T1014",
    "T1562.001",
    "T1548.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit (Kernel-level evasion)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1548.002",
      "name": "Abuse Elevation Control Mechanism: Bypass User Account Control (Required to install driver)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1553.006",
      "name": "Subvert Trust Controls: Code Signing Policy Modification (Loading untrusted drivers)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately physically isolate the infected endpoint from the network to halt the unseen malicious activity.",
    "Do NOT attempt to remove a kernel rootkit from a live, running Windows environment, as the rootkit controls the OS; the system must be completely wiped and reimaged.",
    "Capture a full physical memory image (RAM dump) *before* powering off the machine, as this is the only reliable way to analyze the rootkit's hooks and the hidden payload.",
    "Investigate how the attacker gained the administrative privileges necessary to load a kernel driver in the first place."
  ],
  "what_to_avoid": [
    "Do not trust output from standard command-line tools (like `tasklist` or `netstat`) on a machine suspected of a rootkit infection.",
    "Avoid relying on standard antivirus remediation to 'clean' a rootkit; a full OS reinstall is the only mathematically sound way to restore trust to the endpoint."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}