# What is a Rootkit?

> A rootkit is a collection of code or tools that conceals programs, files, processes, connections, or other activity and helps maintain privileged presence on a compromised system.

- Canonical URL: https://yellowcube.eu/glossary/rootkit/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It can alter or intercept the mechanisms used to report system state. Rootkits may operate in user space, the operating-system kernel, the boot process, firmware, or a virtualization layer.

Attackers commonly deploy a rootkit after gaining access and privilege, then use it to hide another payload or access mechanism. Local tools may receive manipulated results, so investigators compare independent sources and may need trusted external, offline, or lower-level inspection. Placement affects recovery options.

### Key points

- **Concealment:** Rootkits may hook application programming interfaces, replace utilities or libraries, modify kernel components, or tamper with boot and firmware paths to omit or falsify artifacts.
- **Detection:** Look for discrepancies between observations, unexpected privileged modules or drivers, integrity changes, abnormal boot components, and telemetry from outside the suspected boundary.
- **Response:** Preserve evidence, restrict attacker access, identify the initial compromise and hidden payload, and restore affected layers from verified sources. Reinstalling the operating system may not remove lower-level persistence.
- **Important limitation:** The name does not prove Unix “root” access, a particular layer, or complete invisibility. Missing artifacts can also result from faults, unsupported tools, or collection gaps.

### Related terms

[Malware](<https://yellowcube.eu/glossary/malware/>) · [Endpoint detection and response (EDR)](<https://yellowcube.eu/glossary/endpoint-detection-and-response/>) · [Malware analysis](<https://yellowcube.eu/glossary/malware-analysis/>) · [Secure boot](<https://yellowcube.eu/glossary/secure-boot/>) · [Firmware security](<https://yellowcube.eu/glossary/firmware-security/>) · [Backdoor](<https://yellowcube.eu/glossary/backdoor/>) · [Persistence](<https://yellowcube.eu/glossary/persistence/>)

### Sources

[NIST glossary: Rootkit](https://csrc.nist.gov/glossary/term/rootkit) · [MITRE ATT&CK T1014: Rootkit](https://attack.mitre.org/techniques/T1014/) · [MITRE ATT&CK T1542: Pre-OS Boot](https://attack.mitre.org/techniques/T1542/) · [NIST SP 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling](https://csrc.nist.gov/pubs/sp/800/83/r1/final)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.