Class 09 · KP 04 / 25

User-Mode vs Kernel-Mode Rootkits

SSDT hook: redirect a syscall (e.g. NtQueryDirectoryFile) to hide artifacts.

Key Takeaway

Kernel mode trades stability and stealth-of-install for far greater power and far better hiding. Modern defenses (signing, PatchGuard, Secure Boot) have raised the cost of ring 0.