Critical severity Malware

Rootkit

Hides its presence by subverting the operating system itself, often below user space.

Overview

User-mode rootkits hook API calls to hide files, processes and registry keys; bootkits and driver-level rootkits start earlier than the AV product and are far harder to remove.\nThe goal is persistence that survives reboots and ordinary admin scrutiny.\nWhen a rootkit is suspected, offline scanning or a rebuild from known-good media is the only reliable answer.

Indicators of Compromise

Signals that suggest this is present on a system.

Signed drivers from unexpected publishers
Process listings that disagree between two tools
Files visible to one API but not another

References

Related entries

Trojan High
Worm Critical
Mobile Malware High
Fileless Malware Critical

Related glossary terms

CVSS
Common Vulnerability Scoring System. A 0 to 10 severity score built from exploitability an...
Indicator of Compromise (IoC)
A forensic artefact that suggests a system was breached: a file hash, a suspicious domain,...
Cross-Site Scripting (XSS)
Injecting script into a page so it runs in another user's browser session, enabling cookie...

Check your site anyway

This entry is background reading rather than a scanner check. The free scan still reports the exposures we do cover: security headers, TLS, DNS and domain reputation.

Run a free scan

← All malware