WCU / Cybersecurity
HomeCSC 471CSC 472Search /
~/CSC 471/Class 09/KP 01
Class 09 · KP 01 / 25

What Is a Rootkit?

syscalluser → kernelSSDT entryservice tablerootkit handlerhides filesoriginal Nt* fn
SSDT hook: redirect a syscall (e.g. NtQueryDirectoryFile) to hide artifacts.
  • A rootkit is software that gives an attacker privileged (root / SYSTEM) access while actively hiding its own presence from the user and defenders.
  • The name comes from the classic UNIX goal: keep a kit of tools that preserve root access after a break-in.
  • A rootkit is usually not the payload — it is the stealth and persistence layer that protects the payload (backdoor, keylogger, miner, spy implant).
Key Takeaway

A rootkit does not just break in; it makes sure you never find out it is there and never lose it.

BackClass overviewNextThe Goal of Stealth