Rootkit
noun · MITRE ATT&CK T1014
Malware that hides itself and other malicious activity by modifying the operating system, often at the kernel or boot level.
A rootkit's job is concealment. It changes how the operating system reports what is happening, so that files, processes, registry keys or network connections belonging to the attacker simply do not appear when an administrator or security tool looks for them.
Rootkits range from user-mode code that intercepts specific functions, to kernel-mode drivers that run with the highest privileges on the machine, to bootkits that infect the boot process and load before the operating system and its security features. The deeper they sit, the harder they are to detect from inside the infected system, and the more likely the only reliable fix is to rebuild the machine.
Example
An attacker who has gained administrator rights installs a malicious, signed-looking kernel driver. From then on, their backdoor process is invisible in Task Manager and their files do not show up in directory listings, while the backdoor continues to connect to its command-and-control server.
Why it matters for a SOC analyst
Rootkits are a reason to trust telemetry collected from outside the suspicious process: EDR sensors, network data and firewall logs. Protections such as Secure Boot, driver signature enforcement and blocking known vulnerable drivers make kernel rootkits much harder to install. When one is confirmed, plan to reimage the host rather than trying to clean it.
Related terms
- Malware
Any software designed to harm a system or its users, such as viruses, worms, trojans, ransomware, spyware and infostealers.
- EDR
Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.
- Privilege escalation
Gaining higher permissions than an account was given, such as moving from a standard user to local administrator, domain admin or cloud global admin.
- Trojan
Malware disguised as legitimate software, such as a cracked app, a fake update or an invoice, that the victim installs themselves.