{
  "family": "rkit",
  "sample_count": 4,
  "category": "trojan",
  "description": "Rootkit:Win32/Rkit is a generic detection name used by Microsoft Defender to identify advanced, highly privileged malware known as **Rootkits**. Unlike a standard trojan that operates in User Mode (Ring 3), a true rootkit executes in Kernel Mode (Ring 0), granting it absolute authority over the Windows operating system. Its primary purpose is not necessarily payload delivery, but **total stealth**: subverting the OS itself to hide files, processes, registry keys, and network connections from standard antivirus software, EDR sensors, and even the system administrator.<br><br><b>Understanding Rkit (Rootkits)</b><br>To an end-user, a rootkit infection is completely invisible; the computer may function normally, or only slightly slower. For a security analyst, a rootkit represents the ultimate compromise. Because the rootkit lives at a lower level than the antivirus software, it can intercept the API calls the antivirus makes to scan the disk, feeding it 'clean' data while hiding the malicious files. Detecting a rootkit requires specialized tools that look for anomalies and unhooked APIs, or analyzing the system from an offline environment.<br><br><b>Execution and Stealth Mechanics</b><br>Rkit variants are deployed post-exploitation, requiring administrative or SYSTEM privileges to install (`T1543.003`). Once executed, they typically employ techniques like System Service Descriptor Table (SSDT) Hooking (`T1014`) or Direct Kernel Object Manipulation (DKOM). By hooking the SSDT, the rootkit intercepts fundamental system calls (like `NtQuerySystemInformation`, used by Task Manager to list processes). When the OS asks 'What processes are running?', the rootkit modifies the response to remove its own process ID before handing the list back to the OS. DKOM involves directly modifying the `EPROCESS` structures in memory to unlink a running process from the active process list, making it entirely invisible to standard tools (`T1564`). Rootkits also frequently hook the NDIS (Network Driver Interface Specification) layer to hide their outbound C2 communications (`T1562.001`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total loss of system trust. Host-based IoCs are extremely difficult to spot from a live system. Indicators include discrepancies between different types of system API calls (e.g., cross-view analysis where tool A sees a file, but tool B does not), unsigned or suspicious `.sys` drivers loaded into memory, and EDR alerts regarding SSDT modifications or patching of `ntoskrnl.exe`. Network IoCs (beaconing traffic) may still be visible at the firewall, even if they are hidden on the host.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Rkit and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rkit is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rkit establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rkit typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Rkit compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Rkit should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Rkit?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rkit frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Rkit across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Rkit by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1014",
    "T1562.001",
    "T1564",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit (Hooking kernel APIs and SSDT)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1564",
      "name": "Hide Artifacts (DKOM to hide processes)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Loading malicious drivers)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Subverting AV sensors)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Physically disconnect the compromised endpoint from the network; since the host is untrustworthy, you cannot rely on software firewalls to block its traffic.",
    "Do NOT attempt to clean a confirmed kernel-level rootkit; the only remediative action is a complete wipe and reimage of the hard drive.",
    "To perform forensics, you must boot the machine from a known-good Live CD/USB or mount the hard drive externally to bypass the rootkit's API hooks.",
    "Investigate how the attacker gained the necessary administrative or SYSTEM privileges required to install the kernel driver in the first place."
  ],
  "what_to_avoid": [
    "Do not trust the output of standard tools (Task Manager, netstat, even some local EDR queries) on a machine suspected of harboring a rootkit.",
    "Avoid leaving Secure Boot disabled in the BIOS/UEFI, as Secure Boot is a primary defense against the loading of unsigned, malicious rootkit drivers."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}