Rootkits: hiding beneath the system's eye

A rootkit is not for getting in: it is for staying hidden after access, manipulating what the system shows.

Two levels

Userland: hooking APIs (NtQuerySystemInformation, readdir) to filter the attacker's processes/files from listings. Easier, more detectable.

Kernel: a driver manipulating kernel structures — DKOM (Direct Kernel Object Manipulation) unlinking a process from the EPROCESS list, or SSDT hooks. Powerful and stealthy, but on modern Windows it needs signed drivers (hence the abuse of signed vulnerable drivers, BYOVD).

Defence

Secure Boot, Driver Signature Enforcement, HVCI/Kernel CFG. Comparing the system's view with an external one (memory forensics, analysis from a clean boot) reveals the inconsistencies. Microsoft's blocked vulnerable-driver list counters BYOVD.