Rootkit

A rootkit is malicious software whose defining feature is concealment. Where most malware tries to do something — encrypt files, steal credentials, send spam — a rootkit's first job is to make sure that neither it nor the attacker's other tools show up in process lists, file systems, or security scans. The name combines "root," the highest privilege level on Unix systems, with "kit": a toolset for keeping root access invisible.

How it works

Rootkits are classified by how deep they sit. User-mode rootkits intercept the API calls that applications use to list files and processes, filtering out the attacker's entries from the results. Kernel-mode rootkits load as drivers and alter the operating system's own data structures, so even the OS cannot see them honestly — and security software that relies on it inherits the blindness. The deepest variants embed in firmware (UEFI/BIOS) and survive disk wipes and OS reinstalls entirely. Delivery is rarely exotic: a rootkit typically arrives wrapped in a trojan horse, bundled with a remote access trojan, or installed after a social engineering lure — like the ClickFix attacks that talk users into running the attacker's command themselves — then hides whatever payload the attacker installs next, from keyloggers to credential stealers.

How to defend

• Prevent the first execution. Rootkits need privileged installation, so least-privilege accounts, application control, and user training against run-this-command and fake-update lures block the common entry paths.
• Verify from outside the OS. Secure Boot and measured boot catch kernel and firmware tampering; EDR with kernel-integrity monitoring detects hooking that in-OS scanners miss.
• Patch the escalation paths. Most kernel-mode installs chain an initial foothold with a privilege-escalation vulnerability; closing those breaks the chain.
• When confirmed, rebuild rather than clean. Because a rootkit undermines the system's own reporting, reimaging from known-good media — and firmware verification for the deepest variants — is the only trustworthy remediation.