A rootkit is a type of malicious software designed to hide inside the operating system, or even beneath it, and give an attacker privileged, persistent access without the user or security tools noticing. The name combines root, the account with full permissions on Unix systems, and kit, the set of tools that maintains that access. It is rarely the attack itself: it is what allows the attack to last, because it hides the processes, files and connections of other malicious programs.
That is why it is one of the hardest threats to find. A well-built rootkit modifies the very functions the antivirus relies on to check the computer, so the system ends up lying about its own state.
What is a rootkit
Most intruders try not to be seen. A rootkit goes further: it is the intruder who, once inside the building, walks into the security room, edits the camera footage and erases their name from the visitor log. The guards check the screens and everything looks normal, because the screens no longer show the truth.
A rootkit arrives the same way as other malware: an email with an attachment, an unpatched flaw, a program downloaded from an unofficial site or a USB drive. Once installed, it usually serves four purposes: hiding its own presence and that of other programs, surviving reboots, opening a back door so the attacker can return at will and, in many cases, capturing passwords or keystrokes.
Types of rootkits
They are classified by how deep they hide. The lower they operate, the harder they are to find and remove:
| Type | Where it hides | How hard it is to remove | Real-world example |
|---|---|---|---|
| User mode | Inside normal applications and processes. | Medium: security tools usually find it. | The Sony BMG music CDs that, in 2005, installed one to control copying. |
| Kernel mode | In the core of the operating system, with the highest permissions. | High: it controls what the system reports. | Stuxnet, discovered in 2010, used components of this type to hide. |
| Boot and firmware | In the boot process or in the firmware on the computer's motherboard. | Very high: it survives a disk format. | LoJax (2018), the first of its kind seen in real attacks, and BlackLotus (2023), capable of bypassing Windows Secure Boot. |
| Memory | Only in RAM. | It disappears on reboot, although it can reinstall itself. | It often accompanies attacks that leave no files on disk. |
Boot rootkits are the biggest concern for a company: because they live outside the disk, reinstalling the operating system is not enough to remove them. That is why firmware updates should be part of the same patch management process as the rest of your software.
Signs that a computer may have a rootkit
A rootkit is built not to show symptoms, but it almost always leaves some clue. None of them confirms an infection on its own; several together justify a thorough check:
| What you observe | What it may mean |
|---|---|
| The antivirus turns itself off or cannot update. | Something is blocking the tools that could find it. |
| Traffic to unknown addresses when nobody is using the computer. | A back door communicating with the attacker. |
| Configuration changes nobody made: new administrator accounts, a different DNS server, a proxy. | The attacker preparing their access. |
| Blue screens, reboots or slowness with no explanation. | A component poorly integrated into the core of the system. |
| System tools show different data than an external scan. | The system is hiding information. This is the most reliable sign. |
Of all of them, an administrator account nobody created is the easiest to spot when permissions are well managed, because any change stands out right away. We explain how to organize them in our guide to access controls.
How to detect a rootkit in your company
If the system lies, you have to look from a place where the rootkit does not control the answer. These are the methods that work, from the most routine to the least:
- Watch behavior over files. Even if the rootkit hides its files, its actions leave patterns: injecting code into other processes, modifying the kernel, opening persistent connections. An EDR (endpoint detection and response) tool watches those actions in real time.
- Integrity checks. Compare critical system files and the boot process against known versions signed by the manufacturer.
- Analysis from the outside. Boot the computer from clean media or examine the disk from another computer. If the infected system is not running, it cannot deceive you.
- Memory analysis to look for code that does not belong to any installed program.
- Network traffic. The attacker's connections leave through the network, and there the rootkit no longer decides what can be seen.
Traditional antivirus finds known, shallow rootkits but loses against kernel and boot rootkits: it checks the computer with the same functions the rootkit has tampered with. That is why real detection combines tools on the device with monitoring from the outside.
What to do if you find one
The rule is tough but simple: a system with a rootkit can no longer be trusted, even if a tool says it cleaned it. The safe course is to isolate the device, preserve the evidence, reinstall it from a clean image, update the firmware if it was a boot rootkit, change every password that was used on that device and check the other devices for the same fingerprint.
A typical case shows how this plays out. The EDR at a services company detects that an accounting laptop connects to an overseas address every night in the early hours, even though the antivirus reports it as clean. Analysis from external media reveals a kernel rootkit that arrived with a program downloaded from an unofficial site. The laptop is reinstalled from scratch, the passwords typed on it are changed and the devices with the same fingerprint are checked: another one turns up. Without someone reviewing that overnight alert, the access would have stayed open for months. That is how a team that monitors around the clock works, and it is the same approach a SOC uses to catch ransomware in real time.
5 tips to prevent a rootkit
Prevention costs far less than cleanup, especially with boot rootkits:
- Update the system and the firmware. Many rootkits get in through flaws that already have a fix; installing updates on time, including firmware updates, closes that door.
- Configure devices securely. Turn on Secure Boot and protect the firmware settings with a password, as part of system hardening.
- Nobody works as an administrator day to day. Without administrator permissions, most rootkits cannot install themselves in the kernel.
- Only software from official sources. Pirated programs and license activators are one of the most common ways to slip in a rootkit.
- Behavior-based protection and continuous monitoring. An EDR on every device and someone reviewing its alerts turn an attack that lasts months into one that lasts hours.
Frequently asked questions about rootkits
It combines root, the name of the account with full permissions on Unix and Linux systems, and kit, a set of tools. It describes programs that gain that level of control and keep it hidden.
Not exactly. A virus replicates by infecting other files; a rootkit is dedicated to hiding and keeping access. In practice they often travel together: the rootkit hides the virus, Trojan or spyware that does the damage.
It removes user-mode and kernel-mode rootkits, because they live on the disk. It does not remove boot or firmware rootkits, which sit on the motherboard; for those you need to update or reinstall the firmware with the manufacturer's official version.
It is a rootkit that installs itself in the boot process, before the operating system loads. Because it takes control first, it can disable the protections that load afterward. Secure Boot on modern computers is designed to prevent it.
Yes. Some commercial spyware takes full control of a phone with similar techniques. Keeping the system updated, avoiding apps from outside the official stores and managing company phones from a central console greatly reduces the risk.
Your IT team with behavior-based detection tools, or a service that monitors your devices around the clock and reviews every alert, such as TecnetSOC, our SOC as a service.
Levi is passionate about finance and technology, with a strong background in Financial Coordination. However, her true passion and curiosity have led her to explore the fascinating field of cybersecurity and Microsoft innovations. Combining her financial skills with a deep interest in data and systems protection, she has found in blogging a way to share her knowledge and help others understand the importance of staying secure in the digital world.
