Live briefing
Everything about Rootkit
Software designed to enable access to unauthorized locations in a computer
A rootkit is a collection of typically malicious computer software designed to enable access to a computer or to part of its software that would not otherwise be allowed. Rootkits often mask their presence or that of other software. The term rootkit is a compound of "root" and the word "kit". The term "rootkit" has negative connotations through its association with malware. Wikipedia →
🧭 Start here: a 6-step reading path
- Read the overview: RootkitA 5-minute orientation
- Skim a recent paper: Kernel-level hidden rootkit detection based on eBPFInfluential work since 2022
- Pick up a classic book: Linux Server SecurityThe most-reprinted book on the subject
- Read the landmark paper: SMM rootkit: a new breed of OS independent malwareCited 39 times
- Go sideways: AlureonA closely related topic
- Go sideways: Antivirus softwareA closely related topic
📖 Definitions
Noun A set of software tools used by a third party to gain unauthorized access to a computer system and control the system while concealing itself from the user.
Verb To infect (a computer system) with a rootkit.
🏆 Landmark papers (most cited)
SMM rootkit: a new breed of OS independent malware
TKRD: Trusted kernel rootkit detection for cybersecurity of VMs based on machine learning and memory forensic analysis
A Kernel Rootkit Detection Approach Based on Virtualization and Machine Learning
Rootkit threats
Back to Static Analysis for Kernel-Level Rootkit Detection
Systematic Evaluation of Machine Learning and Deep Learning Models for IoT Malware Detection Across Ransomware, Rootkit, Spyware, Trojan, Botnet, Worm, Virus, and Keylogger
The Hidden Threat: Analysis of Linux Rootkit Techniques and Limitations of Current Detection Tools
Detecting and Preventing Kernel Rootkit Attacks with Bus Snooping
🆕 Influential since 2022
Kernel-level hidden rootkit detection based on eBPF
Trace of the Times: Rootkit Detection through Temporal Anomalies in Kernel Activity
Kernel rootkit detection multi class on deep learning techniques
Rootkit hidden process detection in cloud computing: data extraction at hypervisor-level
Rootkit Detecting Application
📚 Books worth reading
Linux Server SecurityChris Binnie · 2016
Rootkits for dummiesLarry Stevenson · 2007- 📕Rootkits for dummiesLarry Stevenson · 2006
Managed code rootkitsErez Metula · 2010
Hacking Exposed Malware & RootkitsMichael A. Davis · 2008
Hacking exposed malware & rootkitsMichael A. Davis · 2010
Countdown to Zero Day: Stuxnet and the Launch of the World's First Digital WeaponKim Zetter · 2014
Hacking exposedChristopher C. Elisan · 2017
Ranked by number of editions on Open Library, a rough measure of how lasting a book is.
🔗 Related topics
- Alureon Alureon (also known as TDSS or TDL-4) is a trojan and rootkit created to steal data by intercepting a system's network traffic and searching for banking…
- Antivirus software Antivirus software (abbreviated to AV software), also known as anti-malware, is software intended to prevent, detect, and remove malware. Antivirus software…
- Kernel Patch Protection Kernel Patch Protection (KPP), informally known as PatchGuard, is a feature of 64-bit (x64) editions of Microsoft Windows that prevents patching the kernel…
- Microsoft Security Essentials Microsoft Security Essentials (MSE) is a discontinued antivirus software (AV) product that provides protection against different types of malicious software…
- BlackLotus BlackLotus is a UEFI bootkit malware discovered publicly in 2022 that bypasses Microsoft's secure boot on fully up-to-date Windows systems. BlackLotus…
- Malware Malware (a portmanteau of malicious software) is any software intentionally designed to cause disruption or destruction to a computer, server, client,…
- Sality Sality is the classification for a family of malicious software (malware) infecting Microsoft Windows system files. Sality was first discovered in 2003…
- Rogue security software Rogue security software is a form of malicious software and internet fraud that misleads users into believing there is a virus on their computer and aims…