Rootkit
Also known as: rootkits
A rootkit is a type of malware designed to hide itself and other malicious software deep inside an operating system, firmware, or even hardware, while giving an attacker privileged control.
It can conceal files, processes, and network connections from security tools. While modern protections such as Secure Boot and kernel integrity checks have made rootkits harder to install, they remain among the most difficult threats to detect and remove.
Rootkit, explained at three levels
At home
A rootkit is malware that hides so well even your antivirus may not see it, like a burglar who also erases the security camera footage.
At work
Rootkits let attackers stay hidden inside systems for long periods, making breaches harder to discover and clean up.
At home
Rootkits work by tampering with the deepest parts of your computer, like the core of the operating system, so they can lie about what's running. Some survive even after you reinstall Windows.
At work
Types include user-mode, kernel-mode, bootkits that load before the operating system, and firmware rootkits in UEFI or device chips. Detection uses integrity checks, memory analysis, and booting from trusted media.
At home
Some anti-cheat software for games runs at the same deep level as rootkits. In my opinion, that's a real trade-off worth knowing about before installing it.
At work
Mitigations include Secure Boot, TPM-based measured boot, firmware updates, blocking vulnerable drivers, and EDR with kernel visibility. When a rootkit is confirmed, rebuilding from known-good media and reflashing firmware is often safer than attempting removal.
Real-world examples
At home
Jerome's computer kept getting reinfected even after antivirus scans said it was clean. A technician found a rootkit and wiped and reinstalled the system from scratch.
At work
Nadia is incident response lead at a Canadian engineering firm. When a rootkit was found on a server, she had it rebuilt from trusted images instead of trying to clean it, ensuring no hidden components remained.
How it compares
| feature | Rootkit | Trojan horse (malware) |
|---|---|---|
| Main purpose | Hide and keep privileged access | Trick users into installing it |
| Location | Deep in system or firmware | Usually a normal program |
| Detection | Very hard | Moderate |
| Removal | Often requires full rebuild | Usually removable |
A trojan gets in by trickery. A rootkit stays by hiding.
For analysts
I'd keep Secure Boot enabled and firmware updated across company devices. And I'd plan to rebuild, not clean, any system where a rootkit is found.
History & origin
The name comes from Unix, where 'root' is the administrator account and a 'kit' was a set of tools to keep it hidden, first seen in the early 1990s. In 2005, researcher Mark Russinovich revealed that Sony BMG music CDs secretly installed rootkit software on Windows PCs to enforce copy protection, leading to lawsuits and recalls. Stuxnet, discovered in 2010, used rootkit techniques to hide its sabotage of Iranian nuclear centrifuges. Researchers later found firmware-level 'bootkits,' such as LoJax in 2018, which survived reinstalling Windows. Microsoft's Secure Boot and driver signing requirements raised the bar, though attackers keep finding vulnerable drivers to exploit. In my view, the Sony case showed that even big companies can behave like malware authors when protecting their business.