{
  "family": "rkit",
  "sample_count": 4,
  "category": "trojan",
  "description": "Rootkit:Win32/Rkit is a generic detection name used by Microsoft Defender to identify advanced, highly privileged malware known as **Rootkits**. Unlike a standard trojan that operates in User Mode (Ring 3), a true rootkit executes in Kernel Mode (Ring 0), granting it absolute authority over the Windows operating system. Its primary purpose is not necessarily payload delivery, but **total stealth**: subverting the OS itself to hide files, processes, registry keys, and network connections from standard antivirus software, EDR sensors, and even the system administrator.<br><br><b>Understanding Rkit (Rootkits)</b><br>To an end-user, a rootkit infection is completely invisible; the computer may function normally, or only slightly slower. For a security analyst, a rootkit represents the ultimate compromise. Because the rootkit lives at a lower level than the antivirus software, it can intercept the API calls the antivirus makes to scan the disk, feeding it 'clean' data while hiding the malicious files. Detecting a rootkit requires specialized tools that look for anomalies and unhooked APIs, or analyzing the system from an offline environment.<br><br><b>Execution and Stealth Mechanics</b><br>Rkit variants are deployed post-exploitation, requiring administrative or SYSTEM privileges to install (`T1543.003`). Once executed, they typically employ techniques like System Service Descriptor Table (SSDT) Hooking (`T1014`) or Direct Kernel Object Manipulation (DKOM). By hooking the SSDT, the rootkit intercepts fundamental system calls (like `NtQuerySystemInformation`, used by Task Manager to list processes). When the OS asks 'What processes are running?', the rootkit modifies the response to remove its own process ID before handing the list back to the OS. DKOM involves directly modifying the `EPROCESS` structures in memory to unlink a running process from the active process list, making it entirely invisible to standard tools (`T1564`). Rootkits also frequently hook the NDIS (Network Driver Interface Specification) layer to hide their outbound C2 communications (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system trust. Host-based IoCs are extremely difficult to spot from a live system. Indicators include discrepancies between different types of system API calls (e.g., cross-view analysis where tool A sees a file, but tool B does not), unsigned or suspicious `.sys` drivers loaded into memory, and EDR alerts regarding SSDT modifications or patching of `ntoskrnl.exe`. Network IoCs (beaconing traffic) may still be visible at the firewall, even if they are hidden on the host.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1014",
    "T1562.001",
    "T1564",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit (Hooking kernel APIs and SSDT)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1564",
      "name": "Hide Artifacts (DKOM to hide processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Loading malicious drivers)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Subverting AV sensors)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Physically disconnect the compromised endpoint from the network; since the host is untrustworthy, you cannot rely on software firewalls to block its traffic.",
    "Do NOT attempt to clean a confirmed kernel-level rootkit; the only remediative action is a complete wipe and reimage of the hard drive.",
    "To perform forensics, you must boot the machine from a known-good Live CD/USB or mount the hard drive externally to bypass the rootkit's API hooks.",
    "Investigate how the attacker gained the necessary administrative or SYSTEM privileges required to install the kernel driver in the first place."
  ],
  "what_to_avoid": [
    "Do not trust the output of standard tools (Task Manager, netstat, even some local EDR queries) on a machine suspected of harboring a rootkit.",
    "Avoid leaving Secure Boot disabled in the BIOS/UEFI, as Secure Boot is a primary defense against the loading of unsigned, malicious rootkit drivers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}