Simple definition
A rootkit consists of malicious components intended to conceal unauthorized presence or activity on a system.
Purpose and use
It seeks to hide files, processes, connections or other evidence so that compromise is harder to observe.
How does it work?
Depending on where it is installed, it may alter system mechanisms or the information presented to analysis tools.
Key points
- Example: network observations conflict with the information reported by local tools on a suspected machine.
- Compare independent evidence sources and, where necessary, use an analysis environment with an established trust basis.
Points to watch
The term rootkit alone does not establish the mechanism or privileges involved. Analysis from inside a compromised system can provide an incomplete view.
In short
A rootkit seeks concealment; trust in the analysis tools and examined system is central.