WCU / Cybersecurity
~/CSC 471/Class 09/KP 19
Class 09 · KP 19 / 25

Stuxnet: The First PLC Rootkit

syscalluser → kernelSSDT entryservice tablerootkit handlerhides filesoriginal Nt* fn
SSDT hook: redirect a syscall (e.g. NtQueryDirectoryFile) to hide artifacts.
  • Beyond hiding on Windows, Stuxnet hid on the PLC itself.
  • It hooked the Siemens Step7 library (s7otbxdx.dll) so that when engineers read the PLC's code, they saw the original, benign logic — not the injected sabotage routine.
  • This is the first known rootkit for an industrial control system — stealth extended into operational technology (OT).
  • Air-gapped? No problem: Stuxnet spread via USB drives, jumping the gap into the isolated plant network.