📖 What is Rootkit?
A Rootkit is a collection of malicious software designed to provide continued privileged access to a computer while actively hiding its presence from the operating system and security tools. It often modifies kernel-level functions to conceal files, processes, and network connections.
"Rootkits are notoriously difficult to detect because they subvert the very tools used to find them; look for keywords like 'stealth' and 'kernel-level' in exam questions."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Rootkit?
- ▸ User-mode rootkits replace standard system binaries or DLLs to intercept API calls, while kernel-mode rootkits modify the OS kernel to hide deeper.
- ▸ Persistence mechanisms like bootkits infect the Master Boot Record (MBR) or UEFI firmware, ensuring the malware loads before the operating system starts.
- ▸ System call hooking allows rootkits to filter results from tools like 'ls' or 'ps', making malicious files and processes invisible to administrators.
- ▸ Detection often requires memory forensics or 'offline' scanning of the disk from a trusted environment to bypass the rootkit's active deception.
🎯 How does Rootkit appear on the PT0-002 Exam?
You may be asked to identify a rootkit when a scenario describes a system showing signs of compromise, but standard administrative tools fail to list the malicious processes, suggesting the OS is lying.
A scenario might describe a persistent infection that survives a full operating system reinstallation. You will need to recognize this as a firmware-level rootkit targeting the UEFI or MBR.
Expect questions where you must choose between live analysis and offline analysis to detect a kernel-level rootkit that is actively subverting the system's API calls to hide its presence.
❓ Frequently Asked Questions
What is the primary difference between a rootkit and a backdoor?
A backdoor provides a covert way to enter a system, while a rootkit's primary purpose is to hide the presence of that backdoor and other malware from the user and security tools.
Why is memory forensics preferred over standard antivirus for rootkit detection?
Standard antivirus relies on the OS to provide file and process information. Since rootkits subvert the OS, they can lie to the AV; memory forensics analyzes raw RAM directly to find the truth.