{
  "family": "ntrootkit",
  "sample_count": 17,
  "category": "trojan",
  "description": "Rootkit:Win32/NtRootkit is a broad, generic classification used by Microsoft Defender for malware that operates at Ring 0 (the Windows kernel level). Its primary function is profound defense evasion: to hide files, processes, network connections, and registry keys from the operating system, the user, and standard user-mode security software.<br><br><b>Understanding NtRootkit</b><br>To an end-user, an NtRootkit infection is entirely invisible; that is its explicit design. For a security analyst, detecting an NtRootkit indicates a total, deep compromise of the endpoint. Because the malware resides in the kernel, it sits 'beneath' traditional antivirus software. When an AV requests a list of running processes or files in a directory, the rootkit intercepts the API call and modifies the results, lying to the OS to conceal its own presence and the presence of any associated payloads (like banking trojans or backdoors).<br><br><b>Execution and Kernel Subversion</b><br>NtRootkits are typically dropped as secondary payloads by sophisticated exploit kits or targeted attacks (`T1105`). To load into the kernel, they must bypass Driver Signature Enforcement (DSE). Attackers achieve this by bringing their own vulnerable, legitimately signed driver (Bring Your Own Vulnerable Driver - BYOVD) and exploiting it to load the malicious rootkit code (`T1068`). Once in the kernel, the rootkit utilizes techniques like Direct Kernel Object Manipulation (DKOM) (`T1014`) to unlink its processes from the Windows EPROCESS list, or hooks the System Service Descriptor Table (SSDT) to intercept and alter system calls.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total system subversion. User-mode EDR and AV cannot be trusted on an infected machine. Detection requires specialized kernel-level scanning, memory forensics (analyzing RAM dumps to find unlinked processes), or offline analysis. IoCs include the presence of unexpected, heavily obfuscated `.sys` files in `C:\\Windows\\System32\\drivers` and anomalous outbound network traffic originating from hidden processes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.001",
    "T1014",
    "T1564",
    "T1068",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (BYOVD)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Kernel Driver)",
      "tactic": "Persistence"
    },
    {
      "id": "T1564",
      "name": "Hide Artifacts",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint from the network; you cannot trust the operating system's reporting of network activity or running processes.",
    "Do NOT attempt to clean the machine using standard antivirus tools while the OS is running; the rootkit will simply hide from the scanner.",
    "Capture a full memory dump (RAM) for forensic analysis using a specialized tool that operates outside of the standard Windows API (if possible).",
    "Assume the endpoint is fundamentally untrustworthy; perform a bare-metal rebuild of the operating system after capturing forensic data."
  ],
  "what_to_avoid": [
    "Do not trust Task Manager, Process Explorer, or standard EDR alerts on the infected machine to provide an accurate picture of the threat.",
    "Avoid reconnecting the machine to the network before a full forensic investigation is complete; rootkits are often used to hide persistent backdoors."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}