What is a rootkit?
A rootkit is malware designed to conceal itself, and often other malware, while keeping privileged access to a system. The name comes from root, the highest level of access on Unix-like systems, and kit, a set of tools. A rootkit's main job is concealment: it alters how the system reports on itself so that malicious files, processes, registry keys and network connections do not appear in the normal tools. An administrator opens Task Manager or lists a directory and sees nothing wrong, because the rootkit is changing the answers those tools receive.
Types of rootkits
Where a rootkit runs decides how far you can trust the system:
- User-mode rootkits run with ordinary program privileges and tamper with user-space tools and libraries. They are serious but more detectable.
- Kernel-mode rootkits load into the operating system kernel, often as a malicious driver, so they can lie to every program on the machine, including antivirus.
- Bootkits infect the boot process, such as the boot loader or boot record, so they load before the operating system and its defenses.
- Firmware rootkits live in UEFI firmware or device firmware and can survive a disk wipe and operating system reinstall.
How rootkits are detected
Because a rootkit controls what the host reports, detection relies on views it cannot easily fake:
- Comparing the host's own report with an outside view, such as network logs showing connections the host claims are not happening
- Offline or boot-time scanning from trusted media, while the suspect operating system is not running
- Secure Boot, which allows only signed boot components to load
- Measured boot, which records hashes of each boot stage in the TPM so an attestation service can detect changes
- Memory forensics on a captured image of RAM
Removing a rootkit
For an ordinary infection, cleaning may be enough. For a suspected kernel-mode rootkit, an on-host cleanup cannot be trusted, because the cleaning tool is asking the compromised kernel whether it is clean. The safer response is to rebuild: reimage from known-good media, restore data from backups taken before the compromise and change credentials that were used on the host. For a bootkit or firmware rootkit, also reflash the firmware from the vendor's image, and treat the hardware as suspect if the firmware cannot be verified.
Rootkit vs. RAT vs. fileless malware
A rootkit hides; a RAT provides remote control. The two often travel together, with a rootkit concealing a RAT. Fileless malware avoids writing files and runs in memory, which also makes it hard to find, but it does not necessarily alter the operating system's view of itself. If a scenario says the host looks clean while outside evidence shows it is compromised, think rootkit.
Rootkit on the CompTIA Security+ exam
Rootkits fall under SY0-801 objective 2.5 as a malware type. Scenario wording that points to one includes malware that tools on the host cannot see, a system that seems clean while network logs show beaconing, kernel or driver tampering and infections that survive a reinstall. Defense answers include Secure Boot, measured boot and offline scanning, and the remediation answer is usually reimaging, not cleaning. Distractors include RAT, logic bomb, fileless malware and privilege escalation. The term also appears in A+ Core 2 (220-1202) objective 2.4.