thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Rootkit

Malware that hides its presence and other malicious activity by subverting the operating system at a deep level.

Definition

Rootkits modify the kernel, drivers, boot process or firmware to conceal files, processes, registry keys and network connections from the OS and security tools. Kernel-mode rootkits are hard to detect from inside the running system, so offline scanning, integrity checking or reimaging are used. Secure Boot and measured boot help prevent boot-level rootkits.

Example

A kernel driver that hides an attacker's process from Task Manager and antivirus.

Exam tip

Because a rootkit compromises the OS itself, the safest remediation answer is to reimage the system.

Related terms