{
  "family": "rootkitdrv",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Behavior:Win32/Rootkitdrv is a critical **Heuristic and Generic Detection** triggered when an endpoint defense platform (like Windows Defender or an EDR agent) detects a malicious, unverified, or highly suspicious kernel-mode driver (`.sys` file) attempting to load into the Windows Operating System. This is a severe alert indicating that an attacker is attempting to deploy a Rootkit to achieve 'Ring 0' privileges.<br><br><b>Understanding Rootkitdrv (Kernel-Level Evasion)</b><br>To an end-user, loading a malicious driver is entirely invisible. For a security team, a Rootkitdrv alert is a worst-case scenario on an endpoint. If a rootkit successfully loads into the kernel (`T1014`), it operates *below* the level of the antivirus software. It can actively intercept OS API calls to hide malicious processes, network connections, and files from user-land security tools (`T1562.001`), making the machine effectively un-trustable.<br><br><b>Execution and Exploitation Mechanics</b><br>Attackers typically deploy malicious drivers by first achieving administrator privileges (`T1068`). To bypass the 64-bit Windows requirement for Driver Signature Enforcement (DSE), attackers use a technique called 'Bring Your Own Vulnerable Driver' (BYOVD - `T1068`). They drop an old, legitimate, digitally signed driver (like from an older version of a hardware utility or anti-cheat engine) that has a known vulnerability. They load this vulnerable driver, exploit it from user-land, and use those escalated privileges to load their unsigned rootkit driver into memory.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is absolute compromise of the endpoint; the OS itself can no longer be trusted to report accurately. Host-based IoCs include EDR alerts for the installation of new System Services (`T1543.003`) pointing to unknown `.sys` files in `C:\\Windows\\System32\\drivers`. Event logs may show unexpected loading of very old, signed drivers (often associated with hardware vendors like ASUS or Capcom) immediately prior to the alert.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Rootkitdrv and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rootkitdrv is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rootkitdrv establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rootkitdrv typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Rootkitdrv compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Rootkitdrv should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Rootkitdrv leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rootkitdrv frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Rootkitdrv maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Rootkitdrv often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1543.003",
    "T1014",
    "T1562.001",
    "T1068"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit (Kernel-level evasion and hooking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (BYOVD attacks)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Loading the driver)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Blinding EDR sensors)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately and physically isolate the endpoint; network connections may be actively hidden by the rootkit.",
    "Do not trust local forensic tools (like Task Manager or local AV scans) as the rootkit will lie to them; memory analysis of a raw RAM dump is required.",
    "Wipe the hard drive completely and reinstall the operating system from a verified, clean image.",
    "Ensure that Windows Defender Application Control (WDAC) is configured to block known vulnerable drivers (Microsoft's Vulnerable Driver Blocklist)."
  ],
  "what_to_avoid": [
    "Do not attempt to 'clean' a rootkit infection; once the kernel is compromised, the only safe remediation is a complete wipe and reinstall.",
    "Avoid trusting network telemetry originating from the infected host, as the rootkit can selectively hide malicious packets."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}