Evasive Malware

14 INTRODUCTION TO ROOTKITS

Rootkits are malware variants that specialize in hiding their presence on a host by first obtaining low-level access to the victim system. The name rootkit originates from Unix, where the root user has the highest level of privileges the system allows. Rootkits use several evasion methods, such as intercepting and modifying communication between kernel and user space and directly tampering with data structures in kernel memory, to hide from endpoint defenses and investigation tools.

This chapter provides an introductory overview of kernel-based rootkits and some of the techniques they use to evade defenses and ...