What Is a Rootkit?
A rootkit is malware designed above all to hide. Rather than acting loudly, it conceals its own presence — and often other malware — while preserving privileged access to the system. The name comes from “root,” the highest privilege level: a rootkit’s job is to keep that access and make sure nobody notices it is there.
How does a rootkit stay hidden?#
By operating at a level below the tools you would use to find it. Rootkits are grouped by the layer they subvert:
| Type | Operates in | Detection difficulty |
|---|---|---|
| User-mode | Applications / libraries | Moderate |
| Kernel-mode | Operating system core | Hard |
| Bootkit | Boot process / bootloader | Very hard |
| Firmware | UEFI / device firmware | Extremely hard |
The deeper the layer, the more it can lie to everything above it. A kernel rootkit can intercept the system calls that list files and processes, editing the answers so its own artifacts simply do not appear — the OS itself reports a clean machine.
Why are rootkits so hard to deal with?#
Because you cannot trust a compromised system to report on itself. If the kernel is subverted, the antivirus asking it questions gets doctored answers. This is why rootkits usually establish persistence and defeat routine scanning.
Rootkits are the stealth specialists of the malware family, closely tied to privilege escalation. More at the Security Fundamentals hub.
Frequently asked questions#
What makes a rootkit different from other malware?
Its defining goal is concealment. Where most malware acts, a rootkit hides — itself and often other malware — while maintaining privileged ("root") access. It subverts the operating system so that files, processes, and network connections it controls become invisible to normal tools and even to the OS.
How do you remove a rootkit?
Because a rootkit can hide from the very system you would use to inspect it, trusted removal usually means booting from known-good external media to scan offline, or rebuilding the machine entirely. For kernel or firmware rootkits, wiping and reinstalling — sometimes reflashing firmware — is often the only reliable cure.