Rootkits are malware variants that specialize in hiding their presence on a host by first obtaining low-level access to the victim system. The name rootkit originates from Unix, where the root user has the highest level of privileges the system allows. Rootkits use several evasion methods, such as intercepting and modifying communication between kernel and user space and directly tampering with data structures in kernel memory, to hide from endpoint defenses and investigation tools.
This chapter provides an introductory overview of kernel-based rootkits and some of the techniques they use to evade defenses and ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month, and much more.
