A rootkit is malware that modifies the operating system kernel or firmware to hide its presence — files, processes, network connections, registry keys — from standard OS tools and security software. Rootkits operate at the highest privilege levels (Ring 0 / kernel mode), making them extremely difficult to detect and remove.
Milestone Year Details First rootkit 1990 Unix rootkit by Lane & Ritchie NTRootkit 1999 First Windows kernel rootkit Hacker Defender 2003 Popular user/kernel mode rootkit FU Rootkit 2005 DKOM (Direct Kernel Object Manipulation) TDL4/TDL4 2010 Bootkit; MBR infection ZeroAccess 2011 P2P botnet + rootkit Necurs 2012 Rootkit + spam botnet UEFI rootkits 2018+ LoJax, MosaicRegressor, CosmicStrand
└─ Load signed/unsigned driver (exploit, stolen cert)
├─ SSDT hooking (syscall interception)
├─ IDT/GDT hooking (interrupts)
├─ DKOM (hide EPROCESS from EPROCESS list)
└─ IRP hooking (file/registry/network filtering)
├─ Files/directories (NtQueryDirectoryFile hook)
├─ Processes (hide EPROCESS from PsActiveProcessHead)
├─ Registry (NtEnumerateKey hook)
├─ Network (TCP/UDP port hiding)
└─ Modules (hide driver from PsLoadedModuleList)
├─ Driver service (auto-start)
├─ Bootkit (MBR/VBR infection)
└─ UEFI firmware (LoJax style)
Rootkit Year Type Notable NTRootkit 1999 Kernel First Windows Hacker Defender 2003 User/Kernel Popular, open-source FU 2005 Kernel DKOM pioneer TDL4 2010 Bootkit MBR, P2P ZeroAccess 2011 Kernel Click fraud, Bitcoin Necurs 2012 Kernel Spam, ransomware dropper LoJax 2018 UEFI APT28, first UEFI CosmicStrand 2022 UEFI Counterfeit hardware
Method Description Memory forensics Volatility3: linux.check_modules, windows.pslist Boot-time scan AV before OS loads Hardware-assisted Intel TXT, AMD SVM, TPM measured boot UEFI scanner CHIPSEC, UEFI Scanner Reinstall + firmware flash Only sure removal for firmware rootkits
✅ Secure Boot + TPM 2.0 + measured boot
✅ Kernel driver signing enforcement
✅ Patch kernel vulnerabilities promptly
✅ EDR with kernel callback monitoring
✅ Memory forensics capability (Volatility3)
✅ Firmware updates from vendor only
✅ TPM 2.0 + measured boot attestation
Technique ID Description Bootkit T1542.003 MBR/VBR infection Kernel Modules T1547.006 Load malicious kernel module Rootkit T1014 Hide artifacts Firmware Corruption T1495 UEFI/BIOS modification
