What Is Rootkit?

A rootkit conceals the presence of malicious activity by subverting the system that would report it. The distinguishing feature is not what it does but that the compromised system cannot be trusted to describe itself.

That property is what makes it serious. Every tool running on the infected system asks the operating system for information, and the operating system has been modified to answer incorrectly.

The levels it can operate at

User level — modifying libraries and applications. Detectable with reasonable effort. Kernel level — operating inside the operating system itself, able to hide processes, files and network connections from everything above it.

Bootkit — loading before the operating system, so it is in place before any protection starts. Firmware — residing in device or system firmware, surviving disk replacement and operating system reinstallation entirely.

Signed driver abuse is the current route

Modern operating systems require kernel drivers to be signed, which raised the bar considerably. The response has been to abuse legitimately signed drivers with vulnerabilities — loading a genuine, trusted driver and exploiting it to obtain kernel access.

Vulnerable driver blocklists address this and are frequently not enabled. It is one of the higher-value hardening settings available on current platforms and it costs nothing to turn on.

Detection requires looking from outside

Because the system lies, detection means comparing what it reports with what is independently observable. Network traffic seen at a switch that the host does not report. Files visible when the disk is examined from another system but not from within.

Memory analysis is the most productive approach, since hiding from a raw memory capture is considerably harder than hiding from an operating system query. Booting from trusted external media and examining the disk offline is the other.

Prevention through platform features

Secure boot, which verifies each stage of startup. Measured boot with attestation, which records what loaded and allows a remote system to check it. Virtualisation-based protection of credentials and kernel integrity.

Firmware update discipline, which is widely neglected. And vulnerable driver blocking. These are largely configuration rather than products, and most estates have some of them available and unused.

Recovery means rebuilding

Removal tools exist and are unreliable, because the thing being removed controls the environment the tool runs in. The sound response is to rebuild from trusted media.

Where firmware compromise is suspected, rebuilding the operating system is insufficient — firmware needs reflashing or the hardware replacing. That is rare, and it is why suspected firmware involvement changes the response substantially.

Virtualisation and cloud change the picture

A virtual machine can be examined from the hypervisor, which sits outside anything running inside it. That makes memory capture and disk inspection straightforward and removes the central difficulty of investigating a system that lies about itself.

In managed cloud services the concern largely moves to the provider, since you do not operate the hypervisor or the firmware. What remains yours is the guest operating system, and the platform integrity features available to it are frequently unused.

Where to start

Check whether secure boot and vulnerable driver blocking are enabled across your estate. Both are supported on current hardware and both are frequently off.

See memory forensics. GuardsArm delivers incident response.