Rootkit

Definitions

1. Rootkit is a type of malicious software designed to gain and maintain privileged, persistent access to a computer system while actively concealing its presence from the operating system, security software, and the user. The name combines root (the Unix term for the highest-privilege administrator account) and kit (a collection of tools). Rootkits operate at different levels: user-mode rootkits hook application-level functions to hide files and processes, kernel-mode rootkits modify the operating system kernel to intercept system calls, bootkit rootkits infect the boot process (MBR or UEFI) to load before the OS, and firmware rootkits embed in hardware firmware like BIOS/UEFI. Because rootkits can manipulate the OS itself, the infected system cannot reliably detect its own compromise, making detection extremely difficult. Anti-rootkit tools scan from outside the running OS (boot-time scans, external media) or use integrity checking to detect modifications. Once a rootkit is confirmed, the recommended response is typically a complete system wipe and reinstall rather than attempting removal, as the rootkit may have compromised detection tools themselves.

   In plain English: Malware that hides so deep in your computer's operating system that even antivirus software can't see it — like an invisible intruder living in your walls.

Etymology

1990

The term 'root kit' first appears in hacker circles, describing a collection of tools to maintain root access on Unix systems after a break-in

1999

Greg Hoglund publishes NTRootkit, one of the first Windows kernel-level rootkits, broadening the concept beyond Unix

2005

Sony BMG ships music CDs with a rootkit DRM system that hides itself from users, causing a massive scandal

Related Terms

• Buffer Overflow
• Backdoor
• Exploit
• Payload
• APT
• Privilege Escalation
• Keylogger
• Threat Model
• Threat Actor
• Advanced Persistent Threat
• Botnet Command and Control
• Content Disarm and Reconstruction
• Domain Generation Algorithm
• Fileless Malware
• Logic Bomb
• Malware
• Malware Analysis
• Malware Sandbox
• Pass the Ticket
• YARA Rule
• Access Broker
• Address Resolution Protocol Attack
• Anti-Debug Technique
• Anti-Emulation
• ARP Cache Poisoning
• ARP Spoofing
• Backdoor Detection
• Beacon
• Boot Sector Virus
• C2 Server
• Confusion
• Counterintelligence
• Custom Exploit
• Custom Payload
• DLL Hijacking
• DLL Injection
• Gzip Bomb
• Hardware Implant
• Implant
• IoT Botnet
• Key Logger
• Memory Injection
• Memory Scraping
• MITM
• Passive Reconnaissance
• Persistent Backdoor
• Persistent Threat
• Polymorphic Malware
• Responsible AI Security