[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GXPSR45G6D2EPX1BCRG4RA":3,"skill-same:01M6GXPSR45G6D2EPX1BCRG4RA":88},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M6GXPSR45G6D2EPX1BCRG4RA","detecting-rootkit-activity",null,"Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-rootkit-activity\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"rootkit","detecting","detecting rootkit activity","activity","view","techniques","presence","calls","connections","call","files","memory forensics","kernel","system","discovery","analysis","kernel-analysis","memory-forensics","cybersecurity","memory","2026-11-10 10:12:30",false,"---\nname: detecting-rootkit-activity\ndescription: >\n  Detects rootkit presence on compromised systems by identifying hidden processes, hooked\n  system calls, modified kernel structures, hidden files, and covert network connections\n  using memory forensics, cross-view detection, and integrity checking techniques.\n  Activates for requests involving rootkit detection, hidden process discovery, kernel\n  integrity checking, or system call hook analysis.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags: [malware, rootkit, detection, kernel-analysis, memory-forensics]\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Detecting Rootkit Activity\n\n## When to Use\n\n- System shows signs of compromise but standard tools (Task Manager, netstat) show nothing abnormal\n- Antivirus\u002FEDR detects rootkit signatures but cannot identify the specific hiding mechanism\n- Memory forensics reveals discrepancies between kernel data structures and user-mode tool output\n- Investigating a persistent threat that survives remediation attempts and system reboots\n- Validating system integrity after a suspected kernel-level compromise\n\n**Do not use** as a first-line detection method; start with standard malware triage and escalate to rootkit analysis when hiding behavior is suspected.\n\n## Prerequisites\n\n- Volatility 3 for memory forensics and kernel structure analysis\n- GMER or Rootkit Revealer (Windows) for live system scanning\n- rkhunter and chkrootkit (Linux) for filesystem and process integrity checks\n- Sysinternals tools (Process Explorer, Autoruns, RootkitRevealer) for Windows analysis\n- Memory dump from the suspected system (WinPmem, LiME)\n- Clean baseline of the OS for comparison (known-good kernel module hashes)\n\n## Workflow\n\n### Step 1: Cross-View Detection for Hidden Processes\n\nCompare process lists from different data sources to find discrepancies:\n\n```bash\n# Volatility: Compare process enumeration methods\n# pslist - walks ActiveProcessLinks (EPROCESS linked list - what rootkits manipulate)\nvol3 -f memory.dmp windows.pslist > pslist_output.txt\n\n# psscan - scans physical memory for EPROCESS pool tags (rootkit-resistant)\nvol3 -f memory.dmp windows.psscan > psscan_output.txt\n\n# Compare outputs to find hidden processes\npython3 \u003C\u003C 'PYEOF'\npslist_pids = set()\npsscan_pids = set()\n\nwith open(\"pslist_output.txt\") as f:\n    for line in f:\n        parts = line.split()\n        if len(parts) > 1 and parts[1].isdigit():\n            pslist_pids.add(int(parts[1]))\n\nwith open(\"psscan_output.txt\") as f:\n    for line in f:\n        parts = line.split()\n        if len(parts) > 1 and parts[1].isdigit():\n            psscan_pids.add(int(parts[1]))\n\nhidden = psscan_pids - pslist_pids\nif hidden:\n    print(f\"[!] HIDDEN PROCESSES DETECTED (in psscan but not pslist):\")\n    for pid in hidden:\n        print(f\"    PID: {pid}\")\nelse:\n    print(\"[*] No hidden processes detected via cross-view analysis\")\nPYEOF\n```\n\n### Step 2: Detect System Call Hooking\n\nIdentify hooks in the System Service Descriptor Table (SSDT) and Import Address Tables:\n\n```bash\n# Check SSDT for hooked system calls\nvol3 -f memory.dmp windows.ssdt\n\n# Identify hooks pointing outside ntoskrnl.exe or win32k.sys\nvol3 -f memory.dmp windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Check for Inline hooks (detour patching)\nvol3 -f memory.dmp windows.apihooks --pid 4  # System process\n\n# IDT (Interrupt Descriptor Table) analysis\nvol3 -f memory.dmp windows.idt\n\n# Check for IRP (I\u002FO Request Packet) hooking on drivers\nvol3 -f memory.dmp windows.driverscan\nvol3 -f memory.dmp windows.driverirp\n```\n\n```\nTypes of Rootkit Hooks:\n━━━━━━━━━━━━━━━━━━━━━\nSSDT Hook:         Modifies System Service Descriptor Table entries to redirect\n                   system calls through rootkit code (filters process\u002Ffile listings)\n\nIAT Hook:          Patches Import Address Table of a process to intercept API calls\n                   before they reach the kernel\n\nInline Hook:       Overwrites the first bytes of a function with a JMP to rootkit code\n                   (detour\u002Ftrampoline technique)\n\nIRP Hook:          Intercepts I\u002FO Request Packets to filter disk\u002Fnetwork operations\n                   at the driver level\n\nDKOM:              Direct Kernel Object Manipulation - unlinking structures like\n                   EPROCESS from the ActiveProcessLinks list without hooking\n```\n\n### Step 3: Analyze Kernel Modules and Drivers\n\nIdentify unauthorized kernel drivers that may be rootkit components:\n\n```bash\n# List all loaded kernel modules\nvol3 -f memory.dmp windows.modules\n\n# Scan for drivers in memory (including hidden\u002Funlinked)\nvol3 -f memory.dmp windows.driverscan\n\n# Compare module lists to find hidden drivers\nvol3 -f memory.dmp windows.modscan > modscan.txt\nvol3 -f memory.dmp windows.modules > modules.txt\n\n# Check driver signatures and verify against known-good baselines\nvol3 -f memory.dmp windows.verinfo\n\n# Dump suspicious driver for static analysis\nvol3 -f memory.dmp windows.moddump --base 0xFFFFF80012340000 --dump\n```\n\n### Step 4: Detect File and Registry Hiding\n\nIdentify files and registry keys hidden by the rootkit:\n\n```bash\n# Linux rootkit detection with rkhunter\nrkhunter --check --skip-keypress --report-warnings-only\n\n# chkrootkit scanning\nchkrootkit -q\n\n# Windows: Compare filesystem views\n# Live system file listing vs Volatility filescan\nvol3 -f memory.dmp windows.filescan > mem_files.txt\n\n# Check for hidden registry keys\nvol3 -f memory.dmp windows.registry.hivelist\nvol3 -f memory.dmp windows.registry.printkey --key \"SYSTEM\\CurrentControlSet\\Services\"\n\n# Look for hidden services (loaded but not in service registry)\nvol3 -f memory.dmp windows.svcscan | grep -i \"kernel\"\n```\n\n### Step 5: Network Connection Analysis\n\nFind hidden network connections and backdoors:\n\n```bash\n# Memory-based network connection enumeration\nvol3 -f memory.dmp windows.netscan\n\n# Compare with live netstat (if available) to find hidden connections\n# Hidden connections: present in memory but not shown by netstat\n\n# Look for raw sockets (often used by rootkits for covert communication)\nvol3 -f memory.dmp windows.netscan | grep RAW\n\n# Check for network filter drivers (NDIS hooks)\nvol3 -f memory.dmp windows.driverscan | grep -i \"ndis\\|tcpip\\|afd\"\n\n# Analyze callback routines registered by drivers\nvol3 -f memory.dmp windows.callbacks\n```\n\n### Step 6: Integrity Verification\n\nVerify system file and kernel integrity:\n\n```bash\n# Check kernel code integrity (compare in-memory kernel to on-disk copy)\nvol3 -f memory.dmp windows.moddump --base 0xFFFFF80070000000 --dump\n# Compare SHA-256 of dumped ntoskrnl.exe with known-good copy\n\n# Windows: System File Checker (on live system)\nsfc \u002Fscannow\n\n# Linux: Package integrity verification\nrpm -Va  # RPM-based systems\ndebsums -c  # Debian-based systems\n\n# Compare critical system binaries\nfind \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin -type f -exec sha256sum {} \\; > current_hashes.txt\n# Compare against baseline: diff baseline_hashes.txt current_hashes.txt\n\n# YARA scan for known rootkit signatures\nvol3 -f memory.dmp yarascan.YaraScan --yara-file rootkit_rules.yar\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Rootkit** | Malware designed to maintain persistent, privileged access while hiding its presence from system administrators and security tools |\n| **DKOM** | Direct Kernel Object Manipulation; technique of modifying kernel data structures (e.g., unlinking EPROCESS) to hide objects without hooking |\n| **SSDT Hooking** | Replacing entries in the System Service Descriptor Table to intercept and filter system call results (hide processes, files, connections) |\n| **Inline Hooking** | Patching the first instructions of a function with a jump to rootkit code; the rootkit can filter the function output before returning |\n| **Cross-View Detection** | Comparing results from multiple enumeration methods (linked list walk vs memory scan) to identify discrepancies caused by hiding |\n| **Kernel Driver** | Code running in kernel mode (Ring 0) with full system access; rootkits use malicious drivers to gain kernel-level control |\n| **Bootkits** | Rootkits that infect the boot process (MBR, VBR, or UEFI firmware) to load before the operating system and security tools |\n\n## Tools & Systems\n\n- **Volatility**: Memory forensics framework providing cross-view detection, SSDT analysis, and kernel structure inspection for rootkit detection\n- **GMER**: Free Windows rootkit detection tool scanning for SSDT hooks, IDT hooks, IRP hooks, and hidden processes\u002Ffiles\u002Fregistry\n- **rkhunter**: Linux rootkit detection tool checking for known rootkit signatures, suspicious files, and system binary modifications\n- **chkrootkit**: Linux tool for detecting rootkit presence through signature-based and anomaly-based checks\n- **Sysinternals RootkitRevealer**: Microsoft tool comparing Windows API results with raw filesystem\u002Fregistry scans to find discrepancies\n\n## Common Scenarios\n\n### Scenario: Investigating a System Where Standard Tools Show No Compromise\n\n**Context**: An endpoint shows network beaconing to a known C2 IP in firewall logs, but the local EDR, Task Manager, and netstat show no suspicious processes or connections. A memory dump has been acquired for analysis.\n\n**Approach**:\n1. Run Volatility `psscan` and compare with `pslist` to identify processes hidden via DKOM\n2. Run `windows.ssdt` to check for system call hooks that filter process and network listings\n3. Run `windows.malfind` to detect injected code in legitimate processes\n4. Run `windows.netscan` to find network connections hidden from user-mode tools\n5. Run `windows.driverscan` to identify malicious kernel drivers enabling the hiding\n6. Dump the rootkit driver and analyze with Ghidra to understand its hooking mechanism\n7. Check for boot persistence (MBR\u002FVBR modifications, UEFI firmware implants)\n\n**Pitfalls**:\n- Running detection tools on the live compromised system (rootkit may hide from or subvert them)\n- Assuming kernel integrity because no SSDT hooks are found (rootkit may use DKOM or inline hooks instead)\n- Not checking for both user-mode and kernel-mode rootkit components (many rootkits have both)\n- Trusting the rootkit scanner results on a live system; always verify with offline memory forensics\n\n## Output Format\n\n```\nROOTKIT DETECTION ANALYSIS REPORT\n====================================\nDump File:        memory.dmp\nSystem:           Windows 10 21H2 x64\nAnalysis Tool:    Volatility 3.2\n\nCROSS-VIEW DETECTION\nProcess List Comparison:\n  pslist processes:  127\n  psscan processes:  129\n  [!] HIDDEN PROCESSES: 2\n    PID 6784: sysmon64.exe (hidden rootkit component)\n    PID 6812: netfilter.exe (hidden network filter)\n\nSSDT HOOK ANALYSIS\n[!] Entry 0x004A (NtQuerySystemInformation) hooked -> driver.sys+0x1200\n[!] Entry 0x0055 (NtQueryDirectoryFile) hooked -> driver.sys+0x1400\n[!] Entry 0x0119 (NtDeviceIoControlFile) hooked -> driver.sys+0x1600\nHook Target: driver.sys at 0xFFFFF800ABCD0000 (unsigned, suspicious)\n\nKERNEL DRIVER ANALYSIS\n[!] driver.sys - No digital signature, loaded at 0xFFFFF800ABCD0000\n    Size: 45,056 bytes\n    SHA-256: abc123def456...\n    IRP Hooks: IRP_MJ_CREATE, IRP_MJ_DEVICE_CONTROL\n    Registry: HKLM\\SYSTEM\\CurrentControlSet\\Services\\MalDriver\n\nHIDDEN NETWORK CONNECTIONS\nPID 6812: 10.1.5.42:49152 -> 185.220.101.42:443 (ESTABLISHED)\n  - Not visible via netstat or user-mode tools\n  - Filtered by NtDeviceIoControlFile SSDT hook\n\nROOTKIT CAPABILITIES\n- Process hiding (DKOM + SSDT)\n- File hiding (NtQueryDirectoryFile hook)\n- Network connection hiding (NtDeviceIoControlFile hook)\n- Kernel-mode persistence (driver service)\n\nREMEDIATION\n- Boot from clean media for offline remediation\n- Remove malicious driver from offline registry\n- Verify MBR\u002FVBR\u002FUEFI integrity for boot persistence\n- Full system rebuild recommended for kernel-level compromise\n```\n","# Detecting Rootkit Activity\n\n## When to Use\n\n- System shows signs of compromise but standard tools (Task Manager, netstat) show nothing abnormal\n- Antivirus\u002FEDR detects rootkit signatures but cannot identify the specific hiding mechanism\n- Memory forensics reveals discrepancies between kernel data structures and user-mode tool output\n- Investigating a persistent threat that survives remediation attempts and system reboots\n- Validating system integrity after a suspected kernel-level compromise\n\n**Do not use** as a first-line detection method; start with standard malware triage and escalate to rootkit analysis when hiding behavior is suspected.\n\n## Prerequisites\n\n- Volatility 3 for memory forensics and kernel structure analysis\n- GMER or Rootkit Revealer (Windows) for live system scanning\n- rkhunter and chkrootkit (Linux) for filesystem and process integrity checks\n- Sysinternals tools (Process Explorer, Autoruns, RootkitRevealer) for Windows analysis\n- Memory dump from the suspected system (WinPmem, LiME)\n- Clean baseline of the OS for comparison (known-good kernel module hashes)\n\n## Workflow\n\n### Step 1: Cross-View Detection for Hidden Processes\n\nCompare process lists from different data sources to find discrepancies:\n\n```bash\n# Volatility: Compare process enumeration methods\n# pslist - walks ActiveProcessLinks (EPROCESS linked list - what rootkits manipulate)\nvol3 -f memory.dmp windows.pslist > pslist_output.txt\n\n# psscan - scans physical memory for EPROCESS pool tags (rootkit-resistant)\nvol3 -f memory.dmp windows.psscan > psscan_output.txt\n\n# Compare outputs to find hidden processes\npython3 \u003C\u003C 'PYEOF'\npslist_pids = set()\npsscan_pids = set()\n\nwith open(\"pslist_output.txt\") as f:\n    for line in f:\n        parts = line.split()\n        if len(parts) > 1 and parts[1].isdigit():\n            pslist_pids.add(int(parts[1]))\n\nwith open(\"psscan_output.txt\") as f:\n    for line in f:\n        parts = line.split()\n        if len(parts) > 1 and parts[1].isdigit():\n            psscan_pids.add(int(parts[1]))\n\nhidden = psscan_pids - pslist_pids\nif hidden:\n    print(f\"[!] HIDDEN PROCESSES DETECTED (in psscan but not pslist):\")\n    for pid in hidden:\n        print(f\"    PID: {pid}\")\nelse:\n    print(\"[*] No hidden processes detected via cross-view analysis\")\nPYEOF\n```\n\n### Step 2: Detect System Call Hooking\n\nIdentify hooks in the System Service Descriptor Table (SSDT) and Import Address Tables:\n\n```bash\n# Check SSDT for hooked system calls\nvol3 -f memory.dmp windows.ssdt\n\n# Identify hooks pointing outside ntoskrnl.exe or win32k.sys\nvol3 -f memory.dmp windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Check for Inline hooks (detour patching)\nvol3 -f memory.dmp windows.apihooks --pid 4  # System process\n\n# IDT (Interrupt Descriptor Table) analysis\nvol3 -f memory.dmp windows.idt\n\n# Check for IRP (I\u002FO Request Packet) hooking on drivers\nvol3 -f memory.dmp windows.driverscan\nvol3 -f memory.dmp windows.driverirp\n```\n\n```\nTypes of Rootkit Hooks:\n━━━━━━━━━━━━━━━━━━━━━\nSSDT Hook:         Modifies System Service Descriptor Table entries to redirect\n                   system calls through rootkit code (filters process\u002Ffile listings)\n\nIAT Hook:          Patches Import Address Table of a process to intercept API calls\n                   before they reach the kernel\n\nInline Hook:       Overwrites the first bytes of a function with a JMP to rootkit code\n                   (detour\u002Ftrampoline technique)\n\nIRP Hook:          Intercepts I\u002FO Request Packets to filter disk\u002Fnetwork operations\n                   at the driver level\n\nDKOM:              Direct Kernel Object Manipulation - unlinking structures like\n                   EPROCESS from the ActiveProcessLinks list without hooking\n```\n\n### Step 3: Analyze Kernel Modules and Drivers\n\nIdentify unauthorized kernel drivers that may be rootkit components:\n\n```bash\n# List all loaded kernel modules\nvol3 -f memory.dmp windows.modules\n\n# Scan for drivers in memory (including hidden\u002Funlinked)\nvol3 -f memory.dmp windows.driverscan\n\n# Compare module lists to find hidden drivers\nvol3 -f memory.dmp windows.modscan > modscan.txt\nvol3 -f memory.dmp windows.modules > modules.txt\n\n# Check driver signatures and verify against known-good baselines\nvol3 -f memory.dmp windows.verinfo\n\n# Dump suspicious driver for static analysis\nvol3 -f memory.dmp windows.moddump --base 0xFFFFF80012340000 --dump\n```\n\n### Step 4: Detect File and Registry Hiding\n\nIdentify files and registry keys hidden by the rootkit:\n\n```bash\n# Linux rootkit detection with rkhunter\nrkhunter --check --skip-keypress --report-warnings-only\n\n# chkrootkit scanning\nchkrootkit -q\n\n# Windows: Compare filesystem views\n# Live system file listing vs Volatility filescan\nvol3 -f memory.dmp windows.filescan > mem_files.txt\n\n# Check for hidden registry keys\nvol3 -f memory.dmp windows.registry.hivelist\nvol3 -f memory.dmp windows.registry.printkey --key \"SYSTEM\\CurrentControlSet\\Services\"\n\n# Look for hidden services (loaded but not in service registry)\nvol3 -f memory.dmp windows.svcscan | grep -i \"kernel\"\n```\n\n### Step 5: Network Connection Analysis\n\nFind hidden network connections and backdoors:\n\n```bash\n# Memory-based network connection enumeration\nvol3 -f memory.dmp windows.netscan\n\n# Compare with live netstat (if available) to find hidden connections\n# Hidden connections: present in memory but not shown by netstat\n\n# Look for raw sockets (often used by rootkits for covert communication)\nvol3 -f memory.dmp windows.netscan | grep RAW\n\n# Check for network filter drivers (NDIS hooks)\nvol3 -f memory.dmp windows.driverscan | grep -i \"ndis\\|tcpip\\|afd\"\n\n# Analyze callback routines registered by drivers\nvol3 -f memory.dmp windows.callbacks\n```\n\n### Step 6: Integrity Verification\n\nVerify system file and kernel integrity:\n\n```bash\n# Check kernel code integrity (compare in-memory kernel to on-disk copy)\nvol3 -f memory.dmp windows.moddump --base 0xFFFFF80070000000 --dump\n# Compare SHA-256 of dumped ntoskrnl.exe with known-good copy\n\n# Windows: System File Checker (on live system)\nsfc \u002Fscannow\n\n# Linux: Package integrity verification\nrpm -Va  # RPM-based systems\ndebsums -c  # Debian-based systems\n\n# Compare critical system binaries\nfind \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin -type f -exec sha256sum {} \\; > current_hashes.txt\n# Compare against baseline: diff baseline_hashes.txt current_hashes.txt\n\n# YARA scan for known rootkit signatures\nvol3 -f memory.dmp yarascan.YaraScan --yara-file rootkit_rules.yar\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Rootkit** | Malware designed to maintain persistent, privileged access while hiding its presence from system administrators and security tools |\n| **DKOM** | Direct Kernel Object Manipulation; technique of modifying kernel data structures (e.g., unlinking EPROCESS) to hide objects without hooking |\n| **SSDT Hooking** | Replacing entries in the System Service Descriptor Table to intercept and filter system call results (hide processes, files, connections) |\n| **Inline Hooking** | Patching the first instructions of a function with a jump to rootkit code; the rootkit can filter the function output before returning |\n| **Cross-View Detection** | Comparing results from multiple enumeration methods (linked list walk vs memory scan) to identify discrepancies caused by hiding |\n| **Kernel Driver** | Code running in kernel mode (Ring 0) with full system access; rootkits use malicious drivers to gain kernel-level control |\n| **Bootkits** | Rootkits that infect the boot process (MBR, VBR, or UEFI firmware) to load before the operating system and security tools |\n\n## Tools & Systems\n\n- **Volatility**: Memory forensics framework providing cross-view detection, SSDT analysis, and kernel structure inspection for rootkit detection\n- **GMER**: Free Windows rootkit detection tool scanning for SSDT hooks, IDT hooks, IRP hooks, and hidden processes\u002Ffiles\u002Fregistry\n- **rkhunter**: Linux rootkit detection tool checking for known rootkit signatures, suspicious files, and system binary modifications\n- **chkrootkit**: Linux tool for detecting rootkit presence through signature-based and anomaly-based checks\n- **Sysinternals RootkitRevealer**: Microsoft tool comparing Windows API results with raw filesystem\u002Fregistry scans to find discrepancies\n\n## Common Scenarios\n\n### Scenario: Investigating a System Where Standard Tools Show No Compromise\n\n**Context**: An endpoint shows network beaconing to a known C2 IP in firewall logs, but the local EDR, Task Manager, and netstat show no suspicious processes or connections. A memory dump has been acquired for analysis.\n\n**Approach**:\n1. Run Volatility `psscan` and compare with `pslist` to identify processes hidden via DKOM\n2. Run `windows.ssdt` to check for system call hooks that filter process and network listings\n3. Run `windows.malfind` to detect injected code in legitimate processes\n4. Run `windows.netscan` to find network connections hidden from user-mode tools\n5. Run `windows.driverscan` to identify malicious kernel drivers enabling the hiding\n6. Dump the rootkit driver and analyze with Ghidra to understand its hooking mechanism\n7. Check for boot persistence (MBR\u002FVBR modifications, UEFI firmware implants)\n\n**Pitfalls**:\n- Running detection tools on the live compromised system (rootkit may hide from or subvert them)\n- Assuming kernel integrity because no SSDT hooks are found (rootkit may use DKOM or inline hooks instead)\n- Not checking for both user-mode and kernel-mode rootkit components (many rootkits have both)\n- Trusting the rootkit scanner results on a live system; always verify with offline memory forensics\n\n## Output Format\n\n```\nROOTKIT DETECTION ANALYSIS REPORT\n====================================\nDump File:        memory.dmp\nSystem:           Windows 10 21H2 x64\nAnalysis Tool:    Volatility 3.2\n\nCROSS-VIEW DETECTION\nProcess List Comparison:\n  pslist processes:  127\n  psscan processes:  129\n  [!] HIDDEN PROCESSES: 2\n    PID 6784: sysmon64.exe (hidden rootkit component)\n    PID 6812: netfilter.exe (hidden network filter)\n\nSSDT HOOK ANALYSIS\n[!] Entry 0x004A (NtQuerySystemInformation) hooked -> driver.sys+0x1200\n[!] Entry 0x0055 (NtQueryDirectoryFile) hooked -> driver.sys+0x1400\n[!] Entry 0x0119 (NtDeviceIoControlFile) hooked -> driver.sys+0x1600\nHook Target: driver.sys at 0xFFFFF800ABCD0000 (unsigned, suspicious)\n\nKERNEL DRIVER ANALYSIS\n[!] driver.sys - No digital signature, loaded at 0xFFFFF800ABCD0000\n    Size: 45,056 bytes\n    SHA-256: abc123def456...\n    IRP Hooks: IRP_MJ_CREATE, IRP_MJ_DEVICE_CONTROL\n    Registry: HKLM\\SYSTEM\\CurrentControlSet\\Services\\MalDriver\n\nHIDDEN NETWORK CONNECTIONS\nPID 6812: 10.1.5.42:49152 -> 185.220.101.42:443 (ESTABLISHED)\n  - Not visible via netstat or user-mode tools\n  - Filtered by NtDeviceIoControlFile SSDT hook\n\nROOTKIT CAPABILITIES\n- Process hiding (DKOM + SSDT)\n- File hiding (NtQueryDirectoryFile hook)\n- Network connection hiding (NtDeviceIoControlFile hook)\n- Kernel-mode persistence (driver service)\n\nREMEDIATION\n- Boot from clean media for offline remediation\n- Remove malicious driver from offline registry\n- Verify MBR\u002FVBR\u002FUEFI integrity for boot persistence\n- Full system rebuild recommended for kernel-level compromise\n```\n",{"name":5,"tags":43,"author":46,"domain":36,"license":14,"version":47,"subdomain":48,"description":49},[44,18,45,34,35],"malware","detection","mahipal","1.0.0","malware-analysis","Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-rootkit-activity",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add micsapp\u002Fmicstec-skills --skill detecting-rootkit-activity",{"tool":63,"command":64},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill detecting-rootkit-activity",{"tool":66,"command":67},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill detecting-rootkit-activity","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-rootkit-activity\u002FSKILL.md",true,[71,76,82],{"path":72,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-rootkit-activity\u002FLICENSE",{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"references\u002Fapi-reference.md","REFERENCE","参考文档",2367,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-rootkit-activity\u002Freferences\u002Fapi-reference.md",{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"scripts\u002Fagent.py","SCRIPT","脚本",8236,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Fdetecting-rootkit-activity\u002Fscripts\u002Fagent.py",[89,127,157,178,198,222],{"skillNo":90,"name":91,"nameZh":6,"description":92,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":106,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[96,101],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode","for",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":141,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[133,134,137,140],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},{"categoryNo":135,"categoryName":136,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":138,"categoryName":139,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[142,143,144,145,108,146,147,148,149,150,151,152,116,117,123,153,154,124,155,156],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":158,"name":159,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":164,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[163],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},[165,166,167,168,108,111,116,117,169,170,171,172,173,174,175,124,176,177,156,126],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":186,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[184,185],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},[187,168,188,116,172,189,108,142,190,191,192,193,117,194,124,195,196,197,125,126],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[205,206,207,144,208,209,210,211,116,212,213,214,215,216,22,217,218,219,220,221],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","project","project work","token","line","sprints",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":93,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":228,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[224,229,230,231,232,233,234,170,235,236],"npm","js","calculate","node","math","user","compute","errors"]