Ntrootkit

Overview

Rootkit:Win32/NtRootkit is a broad, generic classification used by Microsoft Defender for malware that operates at Ring 0 (the Windows kernel level). Its primary function is profound defense evasion: to hide files, processes, network connections, and registry keys from the operating system, the user, and standard user-mode security software.

Understanding NtRootkit
To an end-user, an NtRootkit infection is entirely invisible; that is its explicit design. For a security analyst, detecting an NtRootkit indicates a total, deep compromise of the endpoint. Because the malware resides in the kernel, it sits 'beneath' traditional antivirus software. When an AV requests a list of running processes or files in a directory, the rootkit intercepts the API call and modifies the results, lying to the OS to conceal its own presence and the presence of any associated payloads (like banking trojans or backdoors).

Execution and Kernel Subversion
NtRootkits are typically dropped as secondary payloads by sophisticated exploit kits or targeted attacks (`T1105`). To load into the kernel, they must bypass Driver Signature Enforcement (DSE). Attackers achieve this by bringing their own vulnerable, legitimately signed driver (Bring Your Own Vulnerable Driver - BYOVD) and exploiting it to load the malicious rootkit code (`T1068`). Once in the kernel, the rootkit utilizes techniques like Direct Kernel Object Manipulation (DKOM) (`T1014`) to unlink its processes from the Windows EPROCESS list, or hooks the System Service Descriptor Table (SSDT) to intercept and alter system calls.

Indicators of Compromise & Impact
The impact is total system subversion. User-mode EDR and AV cannot be trusted on an infected machine. Detection requires specialized kernel-level scanning, memory forensics (analyzing RAM dumps to find unlinked processes), or offline analysis. IoCs include the presence of unexpected, heavily obfuscated `.sys` files in `C:\Windows\System32\drivers` and anomalous outbound network traffic originating from hidden processes.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_NTROOTKIT {
    meta:
        description = "Detects Ntrootkit (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "ntrootkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Ntrootkit Activity
id: 1294e50782c4703fe78ec0c59d94b004
status: experimental
description: Detects generic indicators of the ntrootkit malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*ntrootkit*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately isolate the endpoint from the network; you cannot trust the operating system's reporting of network activity or running processes.
2. Do NOT attempt to clean the machine using standard antivirus tools while the OS is running; the rootkit will simply hide from the scanner.
3. Capture a full memory dump (RAM) for forensic analysis using a specialized tool that operates outside of the standard Windows API (if possible).
4. Assume the endpoint is fundamentally untrustworthy; perform a bare-metal rebuild of the operating system after capturing forensic data.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust Task Manager, Process Explorer, or standard EDR alerts on the infected machine to provide an accurate picture of the threat.
2. Avoid reconnecting the machine to the network before a full forensic investigation is complete; rootkits are often used to hide persistent backdoors.

References & External Analysis

• Search "ntrootkit" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Ircbrute
• Gamevance
• Cardspy
• Trjgen
• Mailcheck

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/ntrootkit.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.