[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71F4Z1VMD8GE0DP53E7TQB7":3,"skill-same:01M71F4Z1VMD8GE0DP53E7TQB7":91},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":14,"repositoryHtmlUrl":67,"repositoryHomepageUrl":6,"ownerHtmlUrl":68,"ownerBlogUrl":6,"ownerDescription":69,"updatedAt":70,"install":71,"resources":84},"01M71F4Z1VMD8GE0DP53E7TQB7","family-rootkit-detect",null,"Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Ffamily\u002Frootkit\u002Fdetect\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"rootkit","family","detect","family rootkit detect","t1003","hook","integrity","malware","network","read","de","analysis","Bash","cybersecurity","memory forensics","presence","files","kernel-analysis","cm","memory","2026-11-10 10:12:30",false,"---\nname: family-rootkit-detect\ndescription: Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified kernel structures, hidden files, and covert network connections using memory forensics, cross-view detection, and integrity checking techniques. Activates for requests involving rootkit detection, hidden process discovery, kernel integrity checking, or system call hook analysis.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags:\n- malware\n- rootkit\n- detection\n- kernel-analysis\n- memory-forensics\nnist_csf:\n- DE.AE-02\n- RS.AN-03\n- ID.RA-01\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1003\n- T1014\n- T1059\ncapec: []\n---\n\n# Detecting Rootkit Activity\n\n## When to Use\n\n- System shows signs of compromise but standard tools (Task Manager, netstat) show nothing abnormal\n- Antivirus\u002FEDR detects rootkit signatures but cannot identify the specific hiding mechanism\n- Memory forensics reveals discrepancies between kernel data structures and user-mode tool output\n- Investigating a persistent threat that survives remediation attempts and system reboots\n- Validating system integrity after a suspected kernel-level compromise\n\n**Do not use** as a first-line detection method; start with standard malware triage and escalate to rootkit analysis when hiding behavior is suspected.\n\n## Prerequisites\n\n- Volatility 3 for memory forensics and kernel structure analysis\n- GMER or Rootkit Revealer (Windows) for live system scanning\n- rkhunter and chkrootkit (Linux) for filesystem and process integrity checks\n- Sysinternals tools (Process Explorer, Autoruns, RootkitRevealer) for Windows analysis\n- Memory dump from the suspected system (WinPmem, LiME)\n- Clean baseline of the OS for comparison (known-good kernel module hashes)\n\n## Workflow\n\n### Step 1: Cross-View Detection for Hidden Processes\n\nCompare process lists from different data sources to find discrepancies:\n\n```bash\n# Volatility: Compare process enumeration methods\n# pslist - walks ActiveProcessLinks (EPROCESS linked list - what rootkits manipulate)\nvol3 -f memory.dmp windows.pslist > pslist_output.txt\n\n# psscan - scans physical memory for EPROCESS pool tags (rootkit-resistant)\nvol3 -f memory.dmp windows.psscan > psscan_output.txt\n\n# Compare outputs to find hidden processes\npython3 \u003C\u003C 'PYEOF'\npslist_pids = set()\npsscan_pids = set()\n\nwith open(\"pslist_output.txt\") as f:\n    for line in f:\n        parts = line.split()\n        if len(parts) > 1 and parts[1].isdigit():\n            pslist_pids.add(int(parts[1]))\n\nwith open(\"psscan_output.txt\") as f:\n    for line in f:\n        parts = line.split()\n        if len(parts) > 1 and parts[1].isdigit():\n            psscan_pids.add(int(parts[1]))\n\nhidden = psscan_pids - pslist_pids\nif hidden:\n    print(f\"[!] HIDDEN PROCESSES DETECTED (in psscan but not pslist):\")\n    for pid in hidden:\n        print(f\"    PID: {pid}\")\nelse:\n    print(\"[*] No hidden processes detected via cross-view analysis\")\nPYEOF\n```\n\n### Step 2: Detect System Call Hooking\n\nIdentify hooks in the System Service Descriptor Table (SSDT) and Import Address Tables:\n\n```bash\n# Check SSDT for hooked system calls\nvol3 -f memory.dmp windows.ssdt\n\n# Identify hooks pointing outside ntoskrnl.exe or win32k.sys\nvol3 -f memory.dmp windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Check for Inline hooks (detour patching)\nvol3 -f memory.dmp windows.apihooks --pid 4  # System process\n\n# IDT (Interrupt Descriptor Table) analysis\nvol3 -f memory.dmp windows.idt\n\n# Check for IRP (I\u002FO Request Packet) hooking on drivers\nvol3 -f memory.dmp windows.driverscan\nvol3 -f memory.dmp windows.driverirp\n```\n\n```\nTypes of Rootkit Hooks:\n━━━━━━━━━━━━━━━━━━━━━\nSSDT Hook:         Modifies System Service Descriptor Table entries to redirect\n                   system calls through rootkit code (filters process\u002Ffile listings)\n\nIAT Hook:          Patches Import Address Table of a process to intercept API calls\n                   before they reach the kernel\n\nInline Hook:       Overwrites the first bytes of a function with a JMP to rootkit code\n                   (detour\u002Ftrampoline technique)\n\nIRP Hook:          Intercepts I\u002FO Request Packets to filter disk\u002Fnetwork operations\n                   at the driver level\n\nDKOM:              Direct Kernel Object Manipulation - unlinking structures like\n                   EPROCESS from the ActiveProcessLinks list without hooking\n```\n\n### Step 3: Analyze Kernel Modules and Drivers\n\nIdentify unauthorized kernel drivers that may be rootkit components:\n\n```bash\n# List all loaded kernel modules\nvol3 -f memory.dmp windows.modules\n\n# Scan for drivers in memory (including hidden\u002Funlinked)\nvol3 -f memory.dmp windows.driverscan\n\n# Compare module lists to find hidden drivers\nvol3 -f memory.dmp windows.modscan > modscan.txt\nvol3 -f memory.dmp windows.modules > modules.txt\n\n# Check driver signatures and verify against known-good baselines\nvol3 -f memory.dmp windows.verinfo\n\n# Dump suspicious driver for static analysis\nvol3 -f memory.dmp windows.moddump --base 0xFFFFF80012340000 --dump\n```\n\n### Step 4: Detect File and Registry Hiding\n\nIdentify files and registry keys hidden by the rootkit:\n\n```bash\n# Linux rootkit detection with rkhunter\nrkhunter --check --skip-keypress --report-warnings-only\n\n# chkrootkit scanning\nchkrootkit -q\n\n# Windows: Compare filesystem views\n# Live system file listing vs Volatility filescan\nvol3 -f memory.dmp windows.filescan > mem_files.txt\n\n# Check for hidden registry keys\nvol3 -f memory.dmp windows.registry.hivelist\nvol3 -f memory.dmp windows.registry.printkey --key \"SYSTEM\\CurrentControlSet\\Services\"\n\n# Look for hidden services (loaded but not in service registry)\nvol3 -f memory.dmp windows.svcscan | grep -i \"kernel\"\n```\n\n### Step 5: Network Connection Analysis\n\nFind hidden network connections and backdoors:\n\n```bash\n# Memory-based network connection enumeration\nvol3 -f memory.dmp windows.netscan\n\n# Compare with live netstat (if available) to find hidden connections\n# Hidden connections: present in memory but not shown by netstat\n\n# Look for raw sockets (often used by rootkits for covert communication)\nvol3 -f memory.dmp windows.netscan | grep RAW\n\n# Check for network filter drivers (NDIS hooks)\nvol3 -f memory.dmp windows.driverscan | grep -i \"ndis\\|tcpip\\|afd\"\n\n# Analyze callback routines registered by drivers\nvol3 -f memory.dmp windows.callbacks\n```\n\n### Step 6: Integrity Verification\n\nVerify system file and kernel integrity:\n\n```bash\n# Check kernel code integrity (compare in-memory kernel to on-disk copy)\nvol3 -f memory.dmp windows.moddump --base 0xFFFFF80070000000 --dump\n# Compare SHA-256 of dumped ntoskrnl.exe with known-good copy\n\n# Windows: System File Checker (on live system)\nsfc \u002Fscannow\n\n# Linux: Package integrity verification\nrpm -Va  # RPM-based systems\ndebsums -c  # Debian-based systems\n\n# Compare critical system binaries\nfind \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin -type f -exec sha256sum {} \\; > current_hashes.txt\n# Compare against baseline: diff baseline_hashes.txt current_hashes.txt\n\n# YARA scan for known rootkit signatures\nvol3 -f memory.dmp yarascan.YaraScan --yara-file rootkit_rules.yar\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Rootkit** | Malware designed to maintain persistent, privileged access while hiding its presence from system administrators and security tools |\n| **DKOM** | Direct Kernel Object Manipulation; technique of modifying kernel data structures (e.g., unlinking EPROCESS) to hide objects without hooking |\n| **SSDT Hooking** | Replacing entries in the System Service Descriptor Table to intercept and filter system call results (hide processes, files, connections) |\n| **Inline Hooking** | Patching the first instructions of a function with a jump to rootkit code; the rootkit can filter the function output before returning |\n| **Cross-View Detection** | Comparing results from multiple enumeration methods (linked list walk vs memory scan) to identify discrepancies caused by hiding |\n| **Kernel Driver** | Code running in kernel mode (Ring 0) with full system access; rootkits use malicious drivers to gain kernel-level control |\n| **Bootkits** | Rootkits that infect the boot process (MBR, VBR, or UEFI firmware) to load before the operating system and security tools |\n\n## Tools & Systems\n\n- **Volatility**: Memory forensics framework providing cross-view detection, SSDT analysis, and kernel structure inspection for rootkit detection\n- **GMER**: Free Windows rootkit detection tool scanning for SSDT hooks, IDT hooks, IRP hooks, and hidden processes\u002Ffiles\u002Fregistry\n- **rkhunter**: Linux rootkit detection tool checking for known rootkit signatures, suspicious files, and system binary modifications\n- **chkrootkit**: Linux tool for detecting rootkit presence through signature-based and anomaly-based checks\n- **Sysinternals RootkitRevealer**: Microsoft tool comparing Windows API results with raw filesystem\u002Fregistry scans to find discrepancies\n\n## Common Scenarios\n\n### Scenario: Investigating a System Where Standard Tools Show No Compromise\n\n**Context**: An endpoint shows network beaconing to a known C2 IP in firewall logs, but the local EDR, Task Manager, and netstat show no suspicious processes or connections. A memory dump has been acquired for analysis.\n\n**Approach**:\n1. Run Volatility `psscan` and compare with `pslist` to identify processes hidden via DKOM\n2. Run `windows.ssdt` to check for system call hooks that filter process and network listings\n3. Run `windows.malfind` to detect injected code in legitimate processes\n4. Run `windows.netscan` to find network connections hidden from user-mode tools\n5. Run `windows.driverscan` to identify malicious kernel drivers enabling the hiding\n6. Dump the rootkit driver and analyze with Ghidra to understand its hooking mechanism\n7. Check for boot persistence (MBR\u002FVBR modifications, UEFI firmware implants)\n\n**Pitfalls**:\n- Running detection tools on the live compromised system (rootkit may hide from or subvert them)\n- Assuming kernel integrity because no SSDT hooks are found (rootkit may use DKOM or inline hooks instead)\n- Not checking for both user-mode and kernel-mode rootkit components (many rootkits have both)\n- Trusting the rootkit scanner results on a live system; always verify with offline memory forensics\n\n## Output Format\n\n```\nROOTKIT DETECTION ANALYSIS REPORT\n====================================\nDump File:        memory.dmp\nSystem:           Windows 10 21H2 x64\nAnalysis Tool:    Volatility 3.2\n\nCROSS-VIEW DETECTION\nProcess List Comparison:\n  pslist processes:  127\n  psscan processes:  129\n  [!] HIDDEN PROCESSES: 2\n    PID 6784: sysmon64.exe (hidden rootkit component)\n    PID 6812: netfilter.exe (hidden network filter)\n\nSSDT HOOK ANALYSIS\n[!] Entry 0x004A (NtQuerySystemInformation) hooked -> driver.sys+0x1200\n[!] Entry 0x0055 (NtQueryDirectoryFile) hooked -> driver.sys+0x1400\n[!] Entry 0x0119 (NtDeviceIoControlFile) hooked -> driver.sys+0x1600\nHook Target: driver.sys at 0xFFFFF800ABCD0000 (unsigned, suspicious)\n\nKERNEL DRIVER ANALYSIS\n[!] driver.sys - No digital signature, loaded at 0xFFFFF800ABCD0000\n    Size: 45,056 bytes\n    SHA-256: abc123def456...\n    IRP Hooks: IRP_MJ_CREATE, IRP_MJ_DEVICE_CONTROL\n    Registry: HKLM\\SYSTEM\\CurrentControlSet\\Services\\MalDriver\n\nHIDDEN NETWORK CONNECTIONS\nPID 6812: 10.1.5.42:49152 -> 185.220.101.42:443 (ESTABLISHED)\n  - Not visible via netstat or user-mode tools\n  - Filtered by NtDeviceIoControlFile SSDT hook\n\nROOTKIT CAPABILITIES\n- Process hiding (DKOM + SSDT)\n- File hiding (NtQueryDirectoryFile hook)\n- Network connection hiding (NtDeviceIoControlFile hook)\n- Kernel-mode persistence (driver service)\n\nREMEDIATION\n- Boot from clean media for offline remediation\n- Remove malicious driver from offline registry\n- Verify MBR\u002FVBR\u002FUEFI integrity for boot persistence\n- Full system rebuild recommended for kernel-level compromise\n```\n","# Detecting Rootkit Activity\n\n## When to Use\n\n- System shows signs of compromise but standard tools (Task Manager, netstat) show nothing abnormal\n- Antivirus\u002FEDR detects rootkit signatures but cannot identify the specific hiding mechanism\n- Memory forensics reveals discrepancies between kernel data structures and user-mode tool output\n- Investigating a persistent threat that survives remediation attempts and system reboots\n- Validating system integrity after a suspected kernel-level compromise\n\n**Do not use** as a first-line detection method; start with standard malware triage and escalate to rootkit analysis when hiding behavior is suspected.\n\n## Prerequisites\n\n- Volatility 3 for memory forensics and kernel structure analysis\n- GMER or Rootkit Revealer (Windows) for live system scanning\n- rkhunter and chkrootkit (Linux) for filesystem and process integrity checks\n- Sysinternals tools (Process Explorer, Autoruns, RootkitRevealer) for Windows analysis\n- Memory dump from the suspected system (WinPmem, LiME)\n- Clean baseline of the OS for comparison (known-good kernel module hashes)\n\n## Workflow\n\n### Step 1: Cross-View Detection for Hidden Processes\n\nCompare process lists from different data sources to find discrepancies:\n\n```bash\n# Volatility: Compare process enumeration methods\n# pslist - walks ActiveProcessLinks (EPROCESS linked list - what rootkits manipulate)\nvol3 -f memory.dmp windows.pslist > pslist_output.txt\n\n# psscan - scans physical memory for EPROCESS pool tags (rootkit-resistant)\nvol3 -f memory.dmp windows.psscan > psscan_output.txt\n\n# Compare outputs to find hidden processes\npython3 \u003C\u003C 'PYEOF'\npslist_pids = set()\npsscan_pids = set()\n\nwith open(\"pslist_output.txt\") as f:\n    for line in f:\n        parts = line.split()\n        if len(parts) > 1 and parts[1].isdigit():\n            pslist_pids.add(int(parts[1]))\n\nwith open(\"psscan_output.txt\") as f:\n    for line in f:\n        parts = line.split()\n        if len(parts) > 1 and parts[1].isdigit():\n            psscan_pids.add(int(parts[1]))\n\nhidden = psscan_pids - pslist_pids\nif hidden:\n    print(f\"[!] HIDDEN PROCESSES DETECTED (in psscan but not pslist):\")\n    for pid in hidden:\n        print(f\"    PID: {pid}\")\nelse:\n    print(\"[*] No hidden processes detected via cross-view analysis\")\nPYEOF\n```\n\n### Step 2: Detect System Call Hooking\n\nIdentify hooks in the System Service Descriptor Table (SSDT) and Import Address Tables:\n\n```bash\n# Check SSDT for hooked system calls\nvol3 -f memory.dmp windows.ssdt\n\n# Identify hooks pointing outside ntoskrnl.exe or win32k.sys\nvol3 -f memory.dmp windows.ssdt | grep -v \"ntoskrnl\\|win32k\"\n\n# Check for Inline hooks (detour patching)\nvol3 -f memory.dmp windows.apihooks --pid 4  # System process\n\n# IDT (Interrupt Descriptor Table) analysis\nvol3 -f memory.dmp windows.idt\n\n# Check for IRP (I\u002FO Request Packet) hooking on drivers\nvol3 -f memory.dmp windows.driverscan\nvol3 -f memory.dmp windows.driverirp\n```\n\n```\nTypes of Rootkit Hooks:\n━━━━━━━━━━━━━━━━━━━━━\nSSDT Hook:         Modifies System Service Descriptor Table entries to redirect\n                   system calls through rootkit code (filters process\u002Ffile listings)\n\nIAT Hook:          Patches Import Address Table of a process to intercept API calls\n                   before they reach the kernel\n\nInline Hook:       Overwrites the first bytes of a function with a JMP to rootkit code\n                   (detour\u002Ftrampoline technique)\n\nIRP Hook:          Intercepts I\u002FO Request Packets to filter disk\u002Fnetwork operations\n                   at the driver level\n\nDKOM:              Direct Kernel Object Manipulation - unlinking structures like\n                   EPROCESS from the ActiveProcessLinks list without hooking\n```\n\n### Step 3: Analyze Kernel Modules and Drivers\n\nIdentify unauthorized kernel drivers that may be rootkit components:\n\n```bash\n# List all loaded kernel modules\nvol3 -f memory.dmp windows.modules\n\n# Scan for drivers in memory (including hidden\u002Funlinked)\nvol3 -f memory.dmp windows.driverscan\n\n# Compare module lists to find hidden drivers\nvol3 -f memory.dmp windows.modscan > modscan.txt\nvol3 -f memory.dmp windows.modules > modules.txt\n\n# Check driver signatures and verify against known-good baselines\nvol3 -f memory.dmp windows.verinfo\n\n# Dump suspicious driver for static analysis\nvol3 -f memory.dmp windows.moddump --base 0xFFFFF80012340000 --dump\n```\n\n### Step 4: Detect File and Registry Hiding\n\nIdentify files and registry keys hidden by the rootkit:\n\n```bash\n# Linux rootkit detection with rkhunter\nrkhunter --check --skip-keypress --report-warnings-only\n\n# chkrootkit scanning\nchkrootkit -q\n\n# Windows: Compare filesystem views\n# Live system file listing vs Volatility filescan\nvol3 -f memory.dmp windows.filescan > mem_files.txt\n\n# Check for hidden registry keys\nvol3 -f memory.dmp windows.registry.hivelist\nvol3 -f memory.dmp windows.registry.printkey --key \"SYSTEM\\CurrentControlSet\\Services\"\n\n# Look for hidden services (loaded but not in service registry)\nvol3 -f memory.dmp windows.svcscan | grep -i \"kernel\"\n```\n\n### Step 5: Network Connection Analysis\n\nFind hidden network connections and backdoors:\n\n```bash\n# Memory-based network connection enumeration\nvol3 -f memory.dmp windows.netscan\n\n# Compare with live netstat (if available) to find hidden connections\n# Hidden connections: present in memory but not shown by netstat\n\n# Look for raw sockets (often used by rootkits for covert communication)\nvol3 -f memory.dmp windows.netscan | grep RAW\n\n# Check for network filter drivers (NDIS hooks)\nvol3 -f memory.dmp windows.driverscan | grep -i \"ndis\\|tcpip\\|afd\"\n\n# Analyze callback routines registered by drivers\nvol3 -f memory.dmp windows.callbacks\n```\n\n### Step 6: Integrity Verification\n\nVerify system file and kernel integrity:\n\n```bash\n# Check kernel code integrity (compare in-memory kernel to on-disk copy)\nvol3 -f memory.dmp windows.moddump --base 0xFFFFF80070000000 --dump\n# Compare SHA-256 of dumped ntoskrnl.exe with known-good copy\n\n# Windows: System File Checker (on live system)\nsfc \u002Fscannow\n\n# Linux: Package integrity verification\nrpm -Va  # RPM-based systems\ndebsums -c  # Debian-based systems\n\n# Compare critical system binaries\nfind \u002Fbin \u002Fsbin \u002Fusr\u002Fbin \u002Fusr\u002Fsbin -type f -exec sha256sum {} \\; > current_hashes.txt\n# Compare against baseline: diff baseline_hashes.txt current_hashes.txt\n\n# YARA scan for known rootkit signatures\nvol3 -f memory.dmp yarascan.YaraScan --yara-file rootkit_rules.yar\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Rootkit** | Malware designed to maintain persistent, privileged access while hiding its presence from system administrators and security tools |\n| **DKOM** | Direct Kernel Object Manipulation; technique of modifying kernel data structures (e.g., unlinking EPROCESS) to hide objects without hooking |\n| **SSDT Hooking** | Replacing entries in the System Service Descriptor Table to intercept and filter system call results (hide processes, files, connections) |\n| **Inline Hooking** | Patching the first instructions of a function with a jump to rootkit code; the rootkit can filter the function output before returning |\n| **Cross-View Detection** | Comparing results from multiple enumeration methods (linked list walk vs memory scan) to identify discrepancies caused by hiding |\n| **Kernel Driver** | Code running in kernel mode (Ring 0) with full system access; rootkits use malicious drivers to gain kernel-level control |\n| **Bootkits** | Rootkits that infect the boot process (MBR, VBR, or UEFI firmware) to load before the operating system and security tools |\n\n## Tools & Systems\n\n- **Volatility**: Memory forensics framework providing cross-view detection, SSDT analysis, and kernel structure inspection for rootkit detection\n- **GMER**: Free Windows rootkit detection tool scanning for SSDT hooks, IDT hooks, IRP hooks, and hidden processes\u002Ffiles\u002Fregistry\n- **rkhunter**: Linux rootkit detection tool checking for known rootkit signatures, suspicious files, and system binary modifications\n- **chkrootkit**: Linux tool for detecting rootkit presence through signature-based and anomaly-based checks\n- **Sysinternals RootkitRevealer**: Microsoft tool comparing Windows API results with raw filesystem\u002Fregistry scans to find discrepancies\n\n## Common Scenarios\n\n### Scenario: Investigating a System Where Standard Tools Show No Compromise\n\n**Context**: An endpoint shows network beaconing to a known C2 IP in firewall logs, but the local EDR, Task Manager, and netstat show no suspicious processes or connections. A memory dump has been acquired for analysis.\n\n**Approach**:\n1. Run Volatility `psscan` and compare with `pslist` to identify processes hidden via DKOM\n2. Run `windows.ssdt` to check for system call hooks that filter process and network listings\n3. Run `windows.malfind` to detect injected code in legitimate processes\n4. Run `windows.netscan` to find network connections hidden from user-mode tools\n5. Run `windows.driverscan` to identify malicious kernel drivers enabling the hiding\n6. Dump the rootkit driver and analyze with Ghidra to understand its hooking mechanism\n7. Check for boot persistence (MBR\u002FVBR modifications, UEFI firmware implants)\n\n**Pitfalls**:\n- Running detection tools on the live compromised system (rootkit may hide from or subvert them)\n- Assuming kernel integrity because no SSDT hooks are found (rootkit may use DKOM or inline hooks instead)\n- Not checking for both user-mode and kernel-mode rootkit components (many rootkits have both)\n- Trusting the rootkit scanner results on a live system; always verify with offline memory forensics\n\n## Output Format\n\n```\nROOTKIT DETECTION ANALYSIS REPORT\n====================================\nDump File:        memory.dmp\nSystem:           Windows 10 21H2 x64\nAnalysis Tool:    Volatility 3.2\n\nCROSS-VIEW DETECTION\nProcess List Comparison:\n  pslist processes:  127\n  psscan processes:  129\n  [!] HIDDEN PROCESSES: 2\n    PID 6784: sysmon64.exe (hidden rootkit component)\n    PID 6812: netfilter.exe (hidden network filter)\n\nSSDT HOOK ANALYSIS\n[!] Entry 0x004A (NtQuerySystemInformation) hooked -> driver.sys+0x1200\n[!] Entry 0x0055 (NtQueryDirectoryFile) hooked -> driver.sys+0x1400\n[!] Entry 0x0119 (NtDeviceIoControlFile) hooked -> driver.sys+0x1600\nHook Target: driver.sys at 0xFFFFF800ABCD0000 (unsigned, suspicious)\n\nKERNEL DRIVER ANALYSIS\n[!] driver.sys - No digital signature, loaded at 0xFFFFF800ABCD0000\n    Size: 45,056 bytes\n    SHA-256: abc123def456...\n    IRP Hooks: IRP_MJ_CREATE, IRP_MJ_DEVICE_CONTROL\n    Registry: HKLM\\SYSTEM\\CurrentControlSet\\Services\\MalDriver\n\nHIDDEN NETWORK CONNECTIONS\nPID 6812: 10.1.5.42:49152 -> 185.220.101.42:443 (ESTABLISHED)\n  - Not visible via netstat or user-mode tools\n  - Filtered by NtDeviceIoControlFile SSDT hook\n\nROOTKIT CAPABILITIES\n- Process hiding (DKOM + SSDT)\n- File hiding (NtQueryDirectoryFile hook)\n- Network connection hiding (NtDeviceIoControlFile hook)\n- Kernel-mode persistence (driver service)\n\nREMEDIATION\n- Boot from clean media for offline remediation\n- Remove malicious driver from offline registry\n- Verify MBR\u002FVBR\u002FUEFI integrity for boot persistence\n- Full system rebuild recommended for kernel-level compromise\n```\n",{"name":5,"tags":44,"capec":47,"model":48,"tools":49,"domain":32,"maxTurns":53,"nist_csf":54,"subdomain":59,"description":7,"mitre_attack":60},[26,19,45,36,46],"detection","memory-forensics",[],"sonnet",[50,31,51,52],"Read","Glob","Grep",20,[55,56,57,58],"DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01","malware-analysis",[61,62,63],"T1003","T1014","T1059","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fmalware\u002Ffamily\u002Frootkit\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":72,"prompt":82,"zipAvailable":83},[73,76,79],{"tool":74,"command":75},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill family-rootkit-detect",{"tool":77,"command":78},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill family-rootkit-detect",{"tool":80,"command":81},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill family-rootkit-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Ffamily\u002Frootkit\u002Fdetect\u002FSKILL.md",true,[85],{"path":86,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"index.json","REFERENCE","参考文档",678,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fmalware\u002Ffamily\u002Frootkit\u002Fdetect\u002Findex.json",[92,114,134,155,177,192],{"skillNo":93,"name":94,"nameZh":6,"description":95,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":96,"categories":97,"keywords":98,"publishedAt":39},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[99,21,100,101,102,29,37,103,104,105,106,107,108,109,110,111,112,32,113],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":118,"categories":119,"keywords":120,"publishedAt":39},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[121,99,122,101,123,124,125,32,31,30,126,127,128,129,29,130,131,28,132,133],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":39},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[141,142,143,144,145,146,32,31,147,30,148,149,29,28,150,151,152,153,154,48],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":39},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[21,162,163,164,165,166,167,37,168,32,113,169,170,171,172,173,174,175,176,29],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":39},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[184,185,21,186,164,166,38,37,187,168,32,113,30,188,189,190,191,176,29,103],"thread","processes thread injection detect","injection","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":193,"name":194,"nameZh":6,"description":195,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":196,"categories":197,"keywords":198,"publishedAt":39},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[199,21,164,200,38,37,46,201,32,113,202,203,204,205,206,207,29,103,208,209],"processes hollow technique detect","tree","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]