Rootkits

What it is

Rootkits are components that conceal unauthorized activity by altering what software reports about the system. They may operate in user software, privileged operating-system code, or firmware. Their defining feature is stealth, not one installation method. Deep compromise can make ordinary local inspection unreliable because the inspection tools may receive manipulated information.

How it works

An attacker first obtains sufficient access through another weakness, then installs a component that hides processes, files, or connections. Some operate at higher privilege than ordinary applications; firmware-level cases can survive a normal operating-system reinstall. Not every rootkit has that depth or persistence.

How people get tricked

A tampered driver or update appears legitimate, or a quiet security dashboard is interpreted as proof of health. This often exploits technical trust rather than requiring a fresh deception of the user.

Example scenario

A compromised driver conceals a malicious process from a local process list. A trusted offline examination reveals artifacts that the running operating system did not show.

Warning signs

• Integrity or secure-boot alerts and unexpected privileged drivers.
• Disagreement between trusted external inspection and local reports.
• Repeated compromise after apparently successful cleanup.

If it happens to you

Use trusted investigative tools outside the suspected system where appropriate. Qualified responders should establish the affected layer; reinstalling may suffice for some cases, while firmware remediation or replacement may be necessary for others. Rotate exposed secrets and investigate the original entry path.