<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-rootkit-presence
description: >-
  Detect kernel-level and user-mode rootkits through memory forensics, syscall
  table verification, hidden process enumeration, and integrity checking of
  critical OS structures.
domain: cybersecurity
subdomain: malware-analysis
tags:
  - rootkit
  - kernel-module
  - syscall-hooking
  - process-hiding
  - volatility
  - memory-forensics
  - malware-analysis
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1014"]
---

# Detecting Rootkit Presence

## Overview

Rootkits subvert operating system integrity by hooking system calls, hiding processes/files/network connections, and modifying kernel data structures. They operate at user-mode (LD_PRELOAD/DLL injection), kernel-mode (loadable kernel modules/drivers), or hypervisor level. Detection requires cross-view analysis comparing OS-reported state against raw disk/memory inspection, syscall table integrity verification, and behavioral anomaly detection.

## Prerequisites

- Volatility 3 for memory forensics
- rkhunter / chkrootkit for Linux rootkit scanning
- GMER / TDSSKiller for Windows rootkit detection
- Linux Kernel Module tools (`lsmod`, `modinfo`, `modprobe`)
- Sysdig / eBPF for runtime syscall monitoring
- Trusted boot media for offline analysis

## Key Concepts

### Rootkit Types

| Type | Mechanism | Detection Difficulty |
|------|-----------|---------------------|
| User-mode | LD_PRELOAD, DLL injection, IAT hooks | Moderate |
| Kernel-mode | LKM/driver, SSDT hooks, DKOM | High |
| Bootkits | MBR/VBR/UEFI modification | Very High |
| Hypervisor | Hardware virtualization abuse | Extreme |

### Kernel Hooking Techniques

- **SSDT hooking**: Modifying System Service Descriptor Table entries (Windows)
- **Syscall table modification**: Replacing function pointers in `sys_call_table` (Linux)
- **DKOM**: Direct Kernel Object Manipulation — unlinking EPROCESS entries
- **Inline hooking**: Patching function prologues with JMP to hook handler
- **IDT hooking**: Modifying Interrupt Descriptor Table entries

## Workflow

### Step 1: Baseline System State

```bash
# Linux — capture kernel module list from trusted state
lsmod | sort > /root/baseline_modules.txt
cat /proc/kallsyms > /root/baseline_kallsyms.txt
sha256sum /boot/vmlinuz-$(uname -r) > /root/baseline_kernel_hash.txt

# Verify system binary integrity
debsums -c 2>/dev/null  # Debian/Ubuntu
rpm -Va 2>/dev/null      # RHEL/CentOS

# Windows — baseline drivers and services
sc query type=driver state=all > baseline_drivers.txt
driverquery /v > baseline_driverquery.txt
```

### Step 2: Scan for Known Rootkits

```bash
# Linux — rkhunter
rkhunter --check --skip-keypress --report-warnings-only

# Linux — chkrootkit
chkrootkit -q

# Windows — GMER (GUI) or TDSSKiller
TDSSKiller.exe -l tdsskiller_log.txt -accepteula

# Cross-platform YARA scan
yara -r rootkit_rules.yar /lib/modules/$(uname -r)/
```

### Step 3: Memory Analysis for Hidden Processes

```bash
# Volatility — compare process listing methods
vol3 -f memory.dmp windows.pslist    # Standard process list
vol3 -f memory.dmp windows.psscan    # Pool tag scanning (finds hidden)
vol3 -f memory.dmp windows.pstree    # Process tree

# Diff pslist vs psscan — hidden processes appear only in psscan
diff <(vol3 -f memory.dmp windows.pslist | awk '{print $1}' | sort) \
     <(vol3 -f memory.dmp windows.psscan | awk '{print $1}' | sort)

# Linux memory analysis
vol3 -f memory.dmp linux.pslist
vol3 -f memory.dmp linux.hidden_modules
vol3 -f memory.dmp linux.check_syscall
```

### Step 4: Verify Syscall Table Integrity

```bash
# Linux — check for syscall table hooks
vol3 -f memory.dmp linux.check_syscall

# Linux — compare loaded module addresses against known-good
vol3 -f memory.dmp linux.lsmod
vol3 -f memory.dmp linux.check_modules

# Windows — SSDT hook detection
vol3 -f memory.dmp windows.ssdt

# Check for inline hooks in kernel functions
vol3 -f memory.dmp windows.callbacks
```

### Step 5: Cross-View Analysis

```bash
# Compare filesystem view from OS vs raw disk
# Mount disk read-only from trusted boot media
mount -o ro /dev/sda1 /mnt/suspect

# List files from OS (potentially filtered by rootkit)
ls -laR /mnt/suspect/etc/ > os_view_files.txt

# List from raw disk analysis (bypasses rootkit)
fls -r /dev/sda1 > raw_disk_files.txt

# Compare — rootkit-hidden files appear only in raw view
diff os_view_files.txt raw_disk_files.txt

# Network connection cross-view
ss -tlnp > os_view_network.txt
vol3 -f memory.dmp windows.netscan > memory_view_network.txt
```

## YARA Rule

```yara
rule Linux_Kernel_Rootkit_LKM {
    meta:
        description = "Detects suspicious Linux kernel module with rootkit indicators"
        author = "NERF"
        date = "2026-03-17"
        mitre_attack = "T1014"
        severity = "critical"
    strings:
        $init = "module_init" ascii
        $hide1 = "list_del_init" ascii
        $hide2 = "proc_dir_entry" ascii
        $hook1 = "sys_call_table" ascii
        $hook2 = "set_memory_rw" ascii
        $hook3 = "cr0" ascii
        $net = "netfilter" ascii
    condition:
        uint32(0) == 0x464C457F and
        $init and
        (2 of ($hide*) or 2 of ($hook*)) and
        filesize < 1MB
}
```

## Detection

```yaml
title: Rootkit Presence Detection
id: 2a85a25b-2806-419b-949a-e3bcfc6babd7
status: experimental
description: Detects suspicious activity related to detecting rootkit presence techniques in malware analysis context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*detecting*rootkit*"
  condition: selection
level: high
tags:
  - attack.t1014
  - attack.execution
falsepositives:
  - Sandbox detonation environments analyzing submitted samples
```

## Verification

- [ ] Known rootkit scanners executed (rkhunter, chkrootkit, GMER)
- [ ] Memory dump analyzed for hidden processes (pslist vs psscan diff)
- [ ] Syscall table and SSDT integrity verified
- [ ] Kernel module list compared against baseline
- [ ] Cross-view analysis performed (OS view vs raw disk/memory)
- [ ] System binary integrity verified against package manager
- [ ] Findings mapped to MITRE ATT&CK (T1014, T1562.001)

## References

- [MITRE ATT&CK T1014 — Rootkit](https://attack.mitre.org/techniques/T1014/)
- [Volatility 3 — Memory Forensics](https://github.com/volatilityfoundation/volatility3)
- [rkhunter — Rootkit Hunter](http://rkhunter.sourceforge.net/)
- [GMER — Rootkit Detector](http://www.gmer.net/)
