# Rootkit Techniques Reference

## User-Mode Rootkits

### IAT Hooking
- Modifies Import Address Table entries to redirect API calls
- Targets: CreateFile, FindFirstFile, ReadFile, NtQueryDirectoryFile
- Detection: Compare IAT entries against on-disk DLL export addresses

### Inline Hooking
- Patches first bytes of target function with JMP to rootkit code
- Common patterns: `JMP rel32` (E9), `PUSH addr; RET` (68 xx xx xx xx C3)
- Detection: Check function prologues for unexpected JMP/CALL instructions

### DLL Injection
- Techniques: CreateRemoteThread, QueueUserAPC, SetWindowsHookEx
- Rootkit DLL loaded into target process for API interception
- Detection: Check loaded modules against known-good list

### LD_PRELOAD (Linux)
- Environment variable forces loading of rootkit shared library
- Overrides libc functions (readdir, stat, open)
- Detection: Check LD_PRELOAD, /etc/ld.so.preload

## Kernel-Mode Rootkits

### SSDT Hooking
- Modifies System Service Descriptor Table entries
- Redirects system calls to rootkit handler functions
- Key targets: NtQuerySystemInformation, NtQueryDirectoryFile, NtEnumerateValueKey
- Detection: Verify SSDT entries point to ntoskrnl.exe/win32k.sys

### DKOM (Direct Kernel Object Manipulation)
- Unlinks EPROCESS from ActiveProcessLinks doubly-linked list
- Process invisible to Task Manager and most tools
- Detection: Pool tag scanning (psscan) finds all EPROCESS regardless of list membership

### IRP Hooking
- Replaces IRP dispatch routines in driver objects
- Intercepts I/O requests to hide files, network connections
- Common targets: filesystem drivers, network stack drivers
- Detection: Verify MajorFunction table entries point to correct driver

### Filter Drivers
- Registers as filesystem minifilter or NDIS filter
- Intercepts and modifies I/O at driver stack level
- Can appear legitimate while filtering out rootkit artifacts
- Detection: Enumerate filter drivers with fltmc, check registration

### DKOM Variants
- Thread unlinking from ETHREAD lists
- Handle table manipulation
- Token manipulation for privilege escalation
- Object type hooking

## Hypervisor-Level Rootkits

### Blue Pill Concept
- Migrates running OS into VM controlled by rootkit
- Complete control of hardware access
- Extremely difficult to detect from within guest
- Detection: Timing-based detection, hardware-level analysis

## Firmware/Boot-Level Rootkits

### MBR Bootkits
- Replaces or patches Master Boot Record
- Executes before OS bootloader
- Examples: TDL4, Rovnix, Carberp bootkit
- Detection: Compare MBR against known-good, integrity monitoring

### VBR Bootkits
- Modifies Volume Boot Record or bootloader
- IPL (Initial Program Loader) patching
- Detection: Verify boot sector integrity

### UEFI Implants
- Persists in SPI flash firmware
- Survives OS reinstallation and disk replacement
- Examples: LoJax, MosaicRegressor, CosmicStrand, BlackLotus
- Detection: UEFI firmware verification, Secure Boot validation