{
  "family": "rootkitdrv",
  "sample_count": 3,
  "category": "advanced_threat",
  "description": "Behavior:Win32/Rootkitdrv is a critical **Heuristic and Generic Detection** triggered when an endpoint defense platform (like Windows Defender or an EDR agent) detects a malicious, unverified, or highly suspicious kernel-mode driver (`.sys` file) attempting to load into the Windows Operating System. This is a severe alert indicating that an attacker is attempting to deploy a Rootkit to achieve 'Ring 0' privileges.<br><br><b>Understanding Rootkitdrv (Kernel-Level Evasion)</b><br>To an end-user, loading a malicious driver is entirely invisible. For a security team, a Rootkitdrv alert is a worst-case scenario on an endpoint. If a rootkit successfully loads into the kernel (`T1014`), it operates *below* the level of the antivirus software. It can actively intercept OS API calls to hide malicious processes, network connections, and files from user-land security tools (`T1562.001`), making the machine effectively un-trustable.<br><br><b>Execution and Exploitation Mechanics</b><br>Attackers typically deploy malicious drivers by first achieving administrator privileges (`T1068`). To bypass the 64-bit Windows requirement for Driver Signature Enforcement (DSE), attackers use a technique called 'Bring Your Own Vulnerable Driver' (BYOVD - `T1068`). They drop an old, legitimate, digitally signed driver (like from an older version of a hardware utility or anti-cheat engine) that has a known vulnerability. They load this vulnerable driver, exploit it from user-land, and use those escalated privileges to load their unsigned rootkit driver into memory.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is absolute compromise of the endpoint; the OS itself can no longer be trusted to report accurately. Host-based IoCs include EDR alerts for the installation of new System Services (`T1543.003`) pointing to unknown `.sys` files in `C:\\Windows\\System32\\drivers`. Event logs may show unexpected loading of very old, signed drivers (often associated with hardware vendors like ASUS or Capcom) immediately prior to the alert.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1543.003",
    "T1014",
    "T1562.001",
    "T1068"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1014",
      "name": "Rootkit (Kernel-level evasion and hooking)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (BYOVD attacks)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Loading the driver)",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools (Blinding EDR sensors)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Immediately and physically isolate the endpoint; network connections may be actively hidden by the rootkit.",
    "Do not trust local forensic tools (like Task Manager or local AV scans) as the rootkit will lie to them; memory analysis of a raw RAM dump is required.",
    "Wipe the hard drive completely and reinstall the operating system from a verified, clean image.",
    "Ensure that Windows Defender Application Control (WDAC) is configured to block known vulnerable drivers (Microsoft's Vulnerable Driver Blocklist)."
  ],
  "what_to_avoid": [
    "Do not attempt to 'clean' a rootkit infection; once the kernel is compromised, the only safe remediation is a complete wipe and reinstall.",
    "Avoid trusting network telemetry originating from the infected host, as the rootkit can selectively hide malicious packets."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}