Class 09 · KP 18 / 25

Stuxnet: The Rootkit Layer

SSDT hook: redirect a syscall (e.g. NtQueryDirectoryFile) to hide artifacts.

Two kernel-mode drivers provided stealth on Windows:
mrxcls.sys — loader / injector that launched the payload at boot.
mrxnet.sys — file-system filter that hid Stuxnet's files (the .lnk and .tmp files) from directory listings.
Both drivers were signed with stolen valid code-signing certificates from Realtek and later JMicron.
Valid signatures meant Windows loaded the drivers with no warning — defeating driver-signing trust.

Key Takeaway

Stuxnet weaponized the PKI trust model itself: stolen certs turned "signed = trusted" into "signed = invisible."