SSDT hook: redirect a syscall (e.g. NtQueryDirectoryFile) to hide artifacts.
Beyond hiding on Windows, Stuxnet hid on the PLC itself.
It hooked the Siemens Step7 library (s7otbxdx.dll) so that when engineers read the PLC's code, they saw the original, benign logic — not the injected sabotage routine.
This is the first known rootkit for an industrial control system — stealth extended into operational technology (OT).
Air-gapped? No problem: Stuxnet spread via USB drives, jumping the gap into the isolated plant network.