{
  "family": "ntrootkit",
  "sample_count": 17,
  "category": "rootkit",
  "description": "NTRootkit (classified across cybersecurity vendors as Rootkit:Win32/NTRootkit, Trojan:Win32/NTRootkit, and Rootkit.Win32.NTRoot) is an evasive stealth rootkit engineered for 32-bit and 64-bit Windows NT architecture operating systems. Designed to operate at kernel privilege level (Ring 0) and high user-mode levels (Ring 3), NTRootkit alters operating system behaviors to cloak malicious software presence from administrators, incident response investigators, and antivirus software. NTRootkit leverages techniques including System Service Dispatch Table (SSDT) hooking, Direct Kernel Object Manipulation (DKOM), and I/O Request Packet (IRP) major function table modification. By intercepting core Windows Native API calls (such as NtQuerySystemInformation, NtQueryDirectoryFile, and NtOpenKey), NTRootkit dynamically removes malware processes, dropped binaries, network ports, and autostart registry entries from standard administrative queries. Additionally, NTRootkit provides privileged memory execution primitives and stealth backdoors allowing threat actors to maintain deep persistent access unnoticed for extended periods.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Rootkit:Win32/NTRootkit",
    "Win32/NTRootkit",
    "Rootkit.NTRoot",
    "NTRoot Kernel Driver",
    "Trojan:Win32/NTRootkit"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Rootkit:Win32/NTRootkit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "NTRootkit is a Windows kernel-level and user-mode rootkit designed to hide malicious processes, files, and network activity from detection tools."
      }
    },
    {
      "@type": "Question",
      "name": "How does NTRootkit hide processes from Task Manager?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It hooks NtQuerySystemInformation or uses DKOM to unlink active process blocks from the active process list in kernel memory."
      }
    },
    {
      "@type": "Question",
      "name": "How does NTRootkit achieve execution at the kernel level?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It loads a signed or exploit-vulnerable kernel driver (.sys) to execute code within Ring 0 privileged supervisor space."
      }
    },
    {
      "@type": "Question",
      "name": "Can standard antivirus programs detect an active NTRootkit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Standard user-space tools are blinded; detection requires raw disk reading, kernel memory integrity analysis, or offline boot scanning."
      }
    },
    {
      "@type": "Question",
      "name": "What is the recommended remediation for kernel rootkits like NTRootkit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Due to kernel-level tampering, recommended industry practice is taking forensic memory images followed by clean OS re-imaging."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1014",
    "T1068",
    "T1543.003",
    "T1562.001",
    "T1057",
    "T1083"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (BYOVD)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Kernel Driver)",
      "tactic": "Persistence"
    },
    {
      "id": "T1564",
      "name": "Hide Artifacts",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network; you cannot trust the operating system's reporting of network activity or running processes.",
    "Do NOT attempt to clean the machine using standard antivirus tools while the OS is running; the rootkit will simply hide from the scanner.",
    "Capture a full memory dump (RAM) for forensic analysis using a specialized tool that operates outside of the standard Windows API (if possible).",
    "Assume the endpoint is fundamentally untrustworthy; perform a bare-metal rebuild of the operating system after capturing forensic data."
  ],
  "what_to_avoid": [
    "Do not trust Task Manager, Process Explorer, or standard EDR alerts on the infected machine to provide an accurate picture of the threat.",
    "Avoid reconnecting the machine to the network before a full forensic investigation is complete; rootkits are often used to hide persistent backdoors."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Rootkit:Win32/NTRootkit",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Rootkit:Win32/NTRootkit"
    },
    {
      "name": "Trend Micro Security Research - Rootkit.Win32.NTRoot Analysis",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/rootkit.win32.ntroot"
    },
    {
      "name": "MITRE ATT&CK - Rootkit (T1014)",
      "url": "https://attack.mitre.org/techniques/T1014/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}