Rootkitdrv

Overview

Behavior:Win32/Rootkitdrv is a critical **Heuristic and Generic Detection** triggered when an endpoint defense platform (like Windows Defender or an EDR agent) detects a malicious, unverified, or highly suspicious kernel-mode driver (`.sys` file) attempting to load into the Windows Operating System. This is a severe alert indicating that an attacker is attempting to deploy a Rootkit to achieve 'Ring 0' privileges.

Understanding Rootkitdrv (Kernel-Level Evasion)
To an end-user, loading a malicious driver is entirely invisible. For a security team, a Rootkitdrv alert is a worst-case scenario on an endpoint. If a rootkit successfully loads into the kernel (`T1014`), it operates *below* the level of the antivirus software. It can actively intercept OS API calls to hide malicious processes, network connections, and files from user-land security tools (`T1562.001`), making the machine effectively un-trustable.

Execution and Exploitation Mechanics
Attackers typically deploy malicious drivers by first achieving administrator privileges (`T1068`). To bypass the 64-bit Windows requirement for Driver Signature Enforcement (DSE), attackers use a technique called 'Bring Your Own Vulnerable Driver' (BYOVD - `T1068`). They drop an old, legitimate, digitally signed driver (like from an older version of a hardware utility or anti-cheat engine) that has a known vulnerability. They load this vulnerable driver, exploit it from user-land, and use those escalated privileges to load their unsigned rootkit driver into memory.

Indicators of Compromise & Impact
The impact is absolute compromise of the endpoint; the OS itself can no longer be trusted to report accurately. Host-based IoCs include EDR alerts for the installation of new System Services (`T1543.003`) pointing to unknown `.sys` files in `C:\Windows\System32\drivers`. Event logs may show unexpected loading of very old, signed drivers (often associated with hardware vendors like ASUS or Capcom) immediately prior to the alert.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ROOTKITDRV {
    meta:
        description = "Detects Rootkitdrv (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "rootkitdrv" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Rootkitdrv Activity
id: 2c8593a9b2d75cc926fb283cf9e1b0eb
status: experimental
description: Detects generic indicators of the rootkitdrv malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*rootkitdrv*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately and physically isolate the endpoint; network connections may be actively hidden by the rootkit.
2. Do not trust local forensic tools (like Task Manager or local AV scans) as the rootkit will lie to them; memory analysis of a raw RAM dump is required.
3. Wipe the hard drive completely and reinstall the operating system from a verified, clean image.
4. Ensure that Windows Defender Application Control (WDAC) is configured to block known vulnerable drivers (Microsoft's Vulnerable Driver Blocklist).

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not attempt to 'clean' a rootkit infection; once the kernel is compromised, the only safe remediation is a complete wipe and reinstall.
2. Avoid trusting network telemetry originating from the infected host, as the rootkit can selectively hide malicious packets.

References & External Analysis

• Search "rootkitdrv" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Smartapps
• Spammy
• Superspy
• Spectre
• Flymux

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/rootkitdrv.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.