Rootkit

Rootkits hide the presence of programs, files, network connections, services, drivers, and other system components. Many do this by intercepting and modifying the operating system calls that supply system information. A rootkit typically makes many changes to a host to hide its own existence, which makes it very difficult to tell that it is present or to identify what it has changed.

Rootkit functions can sit at the user or kernel level of the operating system or lower, in a hypervisor or system firmware. Rootkits that reside in or modify boot sectors are called bootkits and target the operating system's boot process. MITRE ATT&CK records rootkits on Windows, Linux, and macOS.

NIST classes rootkits as attacker tools rather than malware in the strict sense: they have no infection capability of their own and rely on malware or other attack mechanisms, such as trojan horses, to install them.

Because rootkits abuse system features, ATT&CK notes that preventive controls cannot easily mitigate them. Its detection guidance looks for behavior such as unauthorized or anomalous loading of kernel-mode drivers, concealed services, and abnormal changes to boot components. When a rootkit has been installed, other malicious actions may also have been performed against the host, so NIST considers rebuilding it the most reliable way to restore its integrity.