Rootkit - what it is, how it hides, and how to detect and remove it

Rootkit

What it is

A rootkit is malware built to hide itself (and other malware) while giving an attacker high-level control of a system. It can live in user space, the kernel, the boot process (bootkit), or even device firmware. Once installed, it can mask files, processes, drivers, and network connections, intercept security tools, and let other threats run with elevated privileges. Background and removal basics: https://gridinsoft.com/rootkit

Why it matters

Rootkits make infections hard to see and hard to remove. They can disable defenses, steal data quietly, and reinstall payloads after you think you’ve cleaned the machine.

How it works - quick tour

  • Entry: phishing, drive-by exploits, or malicious drivers/installers.

  • Hook: intercepts system calls or drivers to hide activity.

  • Persist: lodges in startup, the bootloader, or firmware to survive reboots.

  • Assist: loads additional malware with SYSTEM/admin rights on demand.

Red flags

  • Security tools won’t start, crash, or disagree on what’s running.

  • Unknown drivers/services with random names; blocked attempts to view them.

  • Network activity without matching processes; odd DNS/TLS errors.

  • Secure Boot or driver signing suddenly disabled; unexplained BSODs.

Prevent it

  • Keep OS, drivers, and firmware updated; enable Secure Boot and driver signing.

  • Use least-privilege accounts and block unsigned drivers.

  • Run reputable anti-malware/EDR with kernel-tamper detection.

  • If suspected, isolate the device, collect logs, and reinstall from known-good media; for boot/firmware compromise, reflash firmware and rotate credentials.

    Glossary (A–Z)

    All A B C D E F G H I J K L M N O P Q R S T U V W X Y Z
      • Related Articles

      • UEFI Rootkit

        What it is A UEFI rootkit is malware that hides inside a computer’s firmware - the low-level code that starts your PC before Windows loads. Because it lives in the UEFI (which replaces old BIOS), it can run first at every boot, stay hidden from ...
      • NDR (Network Detection And Response)

        What it is Network Detection and Response (NDR) watches live network traffic to spot and investigate suspicious behavior in real time. Instead of relying on signatures, it analyzes patterns and anomalies to catch threats moving across your ...
      • EDR (Endpoint Detection and Response)

        What it is EDR is your always-on security team for laptops and servers. It watches what’s happening on each device, spots attacks in progress, and helps you respond fast - quarantine, investigate, and clean up. For details on capabilities and use ...
      • XDR (Extended Detection and Response)

        What it is XDR is a security system that watches your company’s devices, email, cloud, and network together and connects the dots. Instead of separate tools, XDR pulls all the signals into one place, spots attacks faster, and can auto-block bad ...
      • XMRig Malware

        What it is XMRig malware is a cryptominer that sneaks onto your PC and secretly mines the Monero (XMR) cryptocurrency using your CPU/GPU. You’ll notice slower performance, hot fans, and higher power bills while attackers collect the coins. It often ...