Summary

• Rootkits = privileged access + active hiding + persistence.
• Ring 3 hooks are easy but local; ring 0 is powerful but risky and now heavily defended.
• Windows: SSDT hooks, DKOM, IRP hooks. Linux: LKM + syscall/ftrace hooks + cred edits. Trend: bootkits/UEFI below the OS.
• Stuxnet showed the full playbook: 0-days, signed rootkit drivers via stolen certs, and the first PLC rootkit — bridging an air gap.
• Detect via cross-view, memory forensics, DSE, PatchGuard, and Secure Boot.