Rkit

Overview

Rootkit:Win32/Rkit is a generic detection name used by Microsoft Defender to identify advanced, highly privileged malware known as **Rootkits**. Unlike a standard trojan that operates in User Mode (Ring 3), a true rootkit executes in Kernel Mode (Ring 0), granting it absolute authority over the Windows operating system. Its primary purpose is not necessarily payload delivery, but **total stealth**: subverting the OS itself to hide files, processes, registry keys, and network connections from standard antivirus software, EDR sensors, and even the system administrator.

Understanding Rkit (Rootkits)
To an end-user, a rootkit infection is completely invisible; the computer may function normally, or only slightly slower. For a security analyst, a rootkit represents the ultimate compromise. Because the rootkit lives at a lower level than the antivirus software, it can intercept the API calls the antivirus makes to scan the disk, feeding it 'clean' data while hiding the malicious files. Detecting a rootkit requires specialized tools that look for anomalies and unhooked APIs, or analyzing the system from an offline environment.

Execution and Stealth Mechanics
Rkit variants are deployed post-exploitation, requiring administrative or SYSTEM privileges to install (`T1543.003`). Once executed, they typically employ techniques like System Service Descriptor Table (SSDT) Hooking (`T1014`) or Direct Kernel Object Manipulation (DKOM). By hooking the SSDT, the rootkit intercepts fundamental system calls (like `NtQuerySystemInformation`, used by Task Manager to list processes). When the OS asks 'What processes are running?', the rootkit modifies the response to remove its own process ID before handing the list back to the OS. DKOM involves directly modifying the `EPROCESS` structures in memory to unlink a running process from the active process list, making it entirely invisible to standard tools (`T1564`). Rootkits also frequently hook the NDIS (Network Driver Interface Specification) layer to hide their outbound C2 communications (`T1562.001`).

Indicators of Compromise & Impact
The impact is total loss of system trust. Host-based IoCs are extremely difficult to spot from a live system. Indicators include discrepancies between different types of system API calls (e.g., cross-view analysis where tool A sees a file, but tool B does not), unsigned or suspicious `.sys` drivers loaded into memory, and EDR alerts regarding SSDT modifications or patching of `ntoskrnl.exe`. Network IoCs (beaconing traffic) may still be visible at the firewall, even if they are hidden on the host.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_RKIT {
    meta:
        description = "Detects Rkit (trojan)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "rkit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Rkit Activity
id: 5160135ec1658341d600d95cd8a6774a
status: experimental
description: Detects generic indicators of the rkit malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*rkit*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Physically disconnect the compromised endpoint from the network; since the host is untrustworthy, you cannot rely on software firewalls to block its traffic.
2. Do NOT attempt to clean a confirmed kernel-level rootkit; the only remediative action is a complete wipe and reimage of the hard drive.
3. To perform forensics, you must boot the machine from a known-good Live CD/USB or mount the hard drive externally to bypass the rootkit's API hooks.
4. Investigate how the attacker gained the necessary administrative or SYSTEM privileges required to install the kernel driver in the first place.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not trust the output of standard tools (Task Manager, netstat, even some local EDR queries) on a machine suspected of harboring a rootkit.
2. Avoid leaving Secure Boot disabled in the BIOS/UEFI, as Secure Boot is a primary defense against the loading of unsigned, malicious rootkit drivers.

References & External Analysis

• Search "rkit" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: trojan)

Explore other malware families in the same category:

• Findkeyxp
• Fenomengame
• Dumpy
• Plead
• Mosucker

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/rkit.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.