Detecting Rootkit Activity

检测Rootkit活动

When to Use

使用场景

System shows signs of compromise but standard tools (Task Manager, netstat) show nothing abnormal
Antivirus/EDR detects rootkit signatures but cannot identify the specific hiding mechanism
Memory forensics reveals discrepancies between kernel data structures and user-mode tool output
Investigating a persistent threat that survives remediation attempts and system reboots
Validating system integrity after a suspected kernel-level compromise

Do not use as a first-line detection method; start with standard malware triage and escalate to rootkit analysis when hiding behavior is suspected.

系统出现被入侵迹象，但标准工具（任务管理器、netstat）未显示任何异常
杀毒软件/EDR检测到Rootkit特征，但无法识别具体的隐藏机制
内存取证发现内核数据结构与用户态工具输出之间存在差异
调查经过修复尝试和系统重启后仍存活的持续性威胁
在怀疑发生内核级入侵后验证系统完整性

请勿将其作为一线检测方法；应先进行标准恶意软件排查，当怀疑存在隐藏行为时再升级到Rootkit分析。

Prerequisites

前置条件

Volatility 3 for memory forensics and kernel structure analysis
GMER or Rootkit Revealer (Windows) for live system scanning
rkhunter and chkrootkit (Linux) for filesystem and process integrity checks
Sysinternals tools (Process Explorer, Autoruns, RootkitRevealer) for Windows analysis
Memory dump from the suspected system (WinPmem, LiME)
Clean baseline of the OS for comparison (known-good kernel module hashes)

用于内存取证和内核结构分析的Volatility 3
用于实时系统扫描的GMER或Rootkit Revealer（Windows）
用于文件系统和进程完整性检查的rkhunter和chkrootkit（Linux）
用于Windows分析的Sysinternals工具（Process Explorer、Autoruns、RootkitRevealer）
来自可疑系统的内存转储（WinPmem、LiME）
用于对比的干净操作系统基线（已知正常的内核模块哈希）

Workflow

工作流程

Step 1: Cross-View Detection for Hidden Processes

步骤1：针对隐藏进程的交叉视图检测

Compare process lists from different data sources to find discrepancies:

bash

undefined

比较来自不同数据源的进程列表以找出差异：

bash

undefined

Volatility: Compare process enumeration methods

pslist - walks ActiveProcessLinks (EPROCESS linked list - what rootkits manipulate)

vol3 -f memory.dmp windows.pslist > pslist_output.txt

psscan - scans physical memory for EPROCESS pool tags (rootkit-resistant)

vol3 -f memory.dmp windows.psscan > psscan_output.txt

Compare outputs to find hidden processes

python3 << 'PYEOF' pslist_pids = set() psscan_pids = set()

with open("pslist_output.txt") as f: for line in f: parts = line.split() if len(parts) > 1 and parts[1].isdigit(): pslist_pids.add(int(parts[1]))

with open("psscan_output.txt") as f: for line in f: parts = line.split() if len(parts) > 1 and parts[1].isdigit(): psscan_pids.add(int(parts[1]))

hidden = psscan_pids - pslist_pids if hidden: print(f"[!] HIDDEN PROCESSES DETECTED (in psscan but not pslist):") for pid in hidden: print(f" PID: {pid}") else: print("[*] No hidden processes detected via cross-view analysis") PYEOF

undefined

python3 << 'PYEOF' pslist_pids = set() psscan_pids = set()

with open("pslist_output.txt") as f: for line in f: parts = line.split() if len(parts) > 1 and parts[1].isdigit(): pslist_pids.add(int(parts[1]))

with open("psscan_output.txt") as f: for line in f: parts = line.split() if len(parts) > 1 and parts[1].isdigit(): psscan_pids.add(int(parts[1]))

hidden = psscan_pids - pslist_pids if hidden: print(f"[!] HIDDEN PROCESSES DETECTED (in psscan but not pslist):") for pid in hidden: print(f" PID: {pid}") else: print("[*] No hidden processes detected via cross-view analysis") PYEOF

undefined

Step 2: Detect System Call Hooking

步骤2：检测系统调用挂钩

Identify hooks in the System Service Descriptor Table (SSDT) and Import Address Tables:

bash

undefined

识别系统服务描述符表（SSDT）和导入地址表中的挂钩：

bash

undefined

Check SSDT for hooked system calls

vol3 -f memory.dmp windows.ssdt

Identify hooks pointing outside ntoskrnl.exe or win32k.sys

vol3 -f memory.dmp windows.ssdt | grep -v "ntoskrnl|win32k"

Check for Inline hooks (detour patching)

vol3 -f memory.dmp windows.apihooks --pid 4 # System process

IDT (Interrupt Descriptor Table) analysis

vol3 -f memory.dmp windows.idt

Check for IRP (I/O Request Packet) hooking on drivers

vol3 -f memory.dmp windows.driverscan vol3 -f memory.dmp windows.driverirp

undefined

Types of Rootkit Hooks: ━━━━━━━━━━━━━━━━━━━━━ SSDT Hook: Modifies System Service Descriptor Table entries to redirect system calls through rootkit code (filters process/file listings)

IAT Hook: Patches Import Address Table of a process to intercept API calls before they reach the kernel

Inline Hook: Overwrites the first bytes of a function with a JMP to rootkit code (detour/trampoline technique)

IRP Hook: Intercepts I/O Request Packets to filter disk/network operations at the driver level

DKOM: Direct Kernel Object Manipulation - unlinking structures like EPROCESS from the ActiveProcessLinks list without hooking

undefined

vol3 -f memory.dmp windows.driverscan vol3 -f memory.dmp windows.driverirp

undefined

Types of Rootkit Hooks: ━━━━━━━━━━━━━━━━━━━━━ SSDT Hook: Modifies System Service Descriptor Table entries to redirect system calls through rootkit code (filters process/file listings)

IAT Hook: Patches Import Address Table of a process to intercept API calls before they reach the kernel

Inline Hook: Overwrites the first bytes of a function with a JMP to rootkit code (detour/trampoline technique)

IRP Hook: Intercepts I/O Request Packets to filter disk/network operations at the driver level

DKOM: Direct Kernel Object Manipulation - unlinking structures like EPROCESS from the ActiveProcessLinks list without hooking

undefined

Step 3: Analyze Kernel Modules and Drivers

步骤3：分析内核模块与驱动程序

Identify unauthorized kernel drivers that may be rootkit components:

bash

undefined

识别可能属于Rootkit组件的未授权内核驱动：

bash

undefined

List all loaded kernel modules

vol3 -f memory.dmp windows.modules

Scan for drivers in memory (including hidden/unlinked)

vol3 -f memory.dmp windows.driverscan

Compare module lists to find hidden drivers

vol3 -f memory.dmp windows.modscan > modscan.txt vol3 -f memory.dmp windows.modules > modules.txt

Check driver signatures and verify against known-good baselines

vol3 -f memory.dmp windows.verinfo

Dump suspicious driver for static analysis

vol3 -f memory.dmp windows.moddump --base 0xFFFFF80012340000 --dump

undefined

vol3 -f memory.dmp windows.moddump --base 0xFFFFF80012340000 --dump

undefined

Step 4: Detect File and Registry Hiding

步骤4：检测文件与注册表隐藏

Identify files and registry keys hidden by the rootkit:

bash

undefined

识别被Rootkit隐藏的文件和注册表项：

bash

undefined

Linux rootkit detection with rkhunter

rkhunter --check --skip-keypress --report-warnings-only

chkrootkit scanning

chkrootkit -q

Windows: Compare filesystem views

Live system file listing vs Volatility filescan

vol3 -f memory.dmp windows.filescan > mem_files.txt

Check for hidden registry keys

vol3 -f memory.dmp windows.registry.hivelist vol3 -f memory.dmp windows.registry.printkey --key "SYSTEM\CurrentControlSet\Services"

Look for hidden services (loaded but not in service registry)

vol3 -f memory.dmp windows.svcscan | grep -i "kernel"

undefined

vol3 -f memory.dmp windows.svcscan | grep -i "kernel"

undefined

Step 5: Network Connection Analysis

步骤5：网络连接分析

Find hidden network connections and backdoors:

bash

undefined

查找隐藏的网络连接和后门：

bash

undefined

Memory-based network connection enumeration

vol3 -f memory.dmp windows.netscan

Compare with live netstat (if available) to find hidden connections

Hidden connections: present in memory but not shown by netstat

Look for raw sockets (often used by rootkits for covert communication)

vol3 -f memory.dmp windows.netscan | grep RAW

Check for network filter drivers (NDIS hooks)

vol3 -f memory.dmp windows.driverscan | grep -i "ndis|tcpip|afd"

Analyze callback routines registered by drivers

vol3 -f memory.dmp windows.callbacks

undefined

vol3 -f memory.dmp windows.callbacks

undefined

Step 6: Integrity Verification

步骤6：完整性验证

Verify system file and kernel integrity:

bash

undefined

验证系统文件和内核完整性：

bash

undefined

Check kernel code integrity (compare in-memory kernel to on-disk copy)

vol3 -f memory.dmp windows.moddump --base 0xFFFFF80070000000 --dump

Compare SHA-256 of dumped ntoskrnl.exe with known-good copy

Windows: System File Checker (on live system)

sfc /scannow

Linux: Package integrity verification

rpm -Va # RPM-based systems debsums -c # Debian-based systems

Compare critical system binaries

find /bin /sbin /usr/bin /usr/sbin -type f -exec sha256sum {} ; > current_hashes.txt

Compare against baseline: diff baseline_hashes.txt current_hashes.txt

YARA scan for known rootkit signatures

vol3 -f memory.dmp yarascan.YaraScan --yara-file rootkit_rules.yar

undefined

vol3 -f memory.dmp yarascan.YaraScan --yara-file rootkit_rules.yar

undefined

Key Concepts

核心概念

Term	Definition
Rootkit	Malware designed to maintain persistent, privileged access while hiding its presence from system administrators and security tools
DKOM	Direct Kernel Object Manipulation; technique of modifying kernel data structures (e.g., unlinking EPROCESS) to hide objects without hooking
SSDT Hooking	Replacing entries in the System Service Descriptor Table to intercept and filter system call results (hide processes, files, connections)
Inline Hooking	Patching the first instructions of a function with a jump to rootkit code; the rootkit can filter the function output before returning
Cross-View Detection	Comparing results from multiple enumeration methods (linked list walk vs memory scan) to identify discrepancies caused by hiding
Kernel Driver	Code running in kernel mode (Ring 0) with full system access; rootkits use malicious drivers to gain kernel-level control
Bootkits	Rootkits that infect the boot process (MBR, VBR, or UEFI firmware) to load before the operating system and security tools

术语	定义
Rootkit	旨在维持持久特权访问，同时向系统管理员和安全工具隐藏自身存在的恶意软件
DKOM	直接内核对象操作；一种修改内核数据结构（例如解除EPROCESS链接）以在不使用挂钩的情况下隐藏对象的技术
SSDT挂钩	替换系统服务描述符表（SSDT）中的条目，以拦截和过滤系统调用结果（隐藏进程、文件、连接）
Inline挂钩	用跳转到Rootkit代码的指令修补函数的前几条指令；Rootkit可以在返回前过滤函数的输出
交叉视图检测	比较多种枚举方法（链表遍历与内存扫描）的结果，以识别由隐藏行为导致的差异
内核驱动程序	运行在内核态（Ring 0）、拥有完全系统访问权限的代码；Rootkit使用恶意驱动程序来获得内核级控制权
Bootkits	感染启动流程（MBR、VBR或UEFI固件）的Rootkit，可在操作系统和安全工具之前加载

Tools & Systems

工具与系统

Volatility: Memory forensics framework providing cross-view detection, SSDT analysis, and kernel structure inspection for rootkit detection
GMER: Free Windows rootkit detection tool scanning for SSDT hooks, IDT hooks, IRP hooks, and hidden processes/files/registry
rkhunter: Linux rootkit detection tool checking for known rootkit signatures, suspicious files, and system binary modifications
chkrootkit: Linux tool for detecting rootkit presence through signature-based and anomaly-based checks
Sysinternals RootkitRevealer: Microsoft tool comparing Windows API results with raw filesystem/registry scans to find discrepancies

Volatility：内存取证框架，提供交叉视图检测、SSDT分析以及内核结构检查功能，用于Rootkit检测
GMER：免费的Windows Rootkit检测工具，可扫描SSDT挂钩、IDT挂钩、IRP挂钩以及隐藏的进程/文件/注册表
rkhunter：Linux Rootkit检测工具，用于检查已知Rootkit特征、可疑文件以及系统二进制文件的修改
chkrootkit：Linux工具，通过基于特征和基于异常的检查来检测Rootkit的存在
Sysinternals RootkitRevealer：微软推出的工具，通过比较Windows API返回结果与原始文件系统/注册表扫描结果来发现差异

Common Scenarios

常见场景

Scenario: Investigating a System Where Standard Tools Show No Compromise

场景：调查标准工具未显示入侵迹象的系统

Context: An endpoint shows network beaconing to a known C2 IP in firewall logs, but the local EDR, Task Manager, and netstat show no suspicious processes or connections. A memory dump has been acquired for analysis.

Approach:

Run Volatility
```
psscan
```
and compare with
```
pslist
```
to identify processes hidden via DKOM
Run
```
windows.ssdt
```
to check for system call hooks that filter process and network listings
Run
```
windows.malfind
```
to detect injected code in legitimate processes
Run
```
windows.netscan
```
to find network connections hidden from user-mode tools
Run
```
windows.driverscan
```
to identify malicious kernel drivers enabling the hiding
Dump the rootkit driver and analyze with Ghidra to understand its hooking mechanism
Check for boot persistence (MBR/VBR modifications, UEFI firmware implants)

Pitfalls:

Running detection tools on the live compromised system (rootkit may hide from or subvert them)
Assuming kernel integrity because no SSDT hooks are found (rootkit may use DKOM or inline hooks instead)
Not checking for both user-mode and kernel-mode rootkit components (many rootkits have both)
Trusting the rootkit scanner results on a live system; always verify with offline memory forensics

背景：防火墙日志显示某端点向已知C2 IP发送网络信标，但本地EDR、任务管理器和netstat未显示可疑进程或连接。已获取该系统的内存转储用于分析。

方法：

运行Volatility
```
psscan
```
命令，并与
```
pslist
```
的结果对比，以识别通过DKOM隐藏的进程
运行
```
windows.ssdt
```
命令，检查是否存在过滤进程和网络列表的系统调用挂钩
运行
```
windows.malfind
```
命令，检测合法进程中的注入代码
运行
```
windows.netscan
```
命令，查找对用户态工具隐藏的网络连接
运行
```
windows.driverscan
```
命令，识别实现隐藏功能的恶意内核驱动
转储Rootkit驱动程序，并使用Ghidra进行分析，以了解其挂钩机制
检查启动持久性（MBR/VBR修改、UEFI固件植入）

注意事项：

在受入侵的活动系统上运行检测工具（Rootkit可能会隐藏自身或破坏检测工具）
因未发现SSDT挂钩就认为内核是完整的（Rootkit可能改用DKOM或inline挂钩）
未同时检查用户态和内核态的Rootkit组件（许多Rootkit同时包含两者）
信任活动系统上的Rootkit扫描器结果；应始终通过离线内存取证进行验证

Output Format

输出格式

ROOTKIT DETECTION ANALYSIS REPORT
====================================
Dump File:        memory.dmp
System:           Windows 10 21H2 x64
Analysis Tool:    Volatility 3.2

CROSS-VIEW DETECTION
Process List Comparison:
  pslist processes:  127
  psscan processes:  129
  [!] HIDDEN PROCESSES: 2
    PID 6784: sysmon64.exe (hidden rootkit component)
    PID 6812: netfilter.exe (hidden network filter)

SSDT HOOK ANALYSIS
[!] Entry 0x004A (NtQuerySystemInformation) hooked -> driver.sys+0x1200
[!] Entry 0x0055 (NtQueryDirectoryFile) hooked -> driver.sys+0x1400
[!] Entry 0x0119 (NtDeviceIoControlFile) hooked -> driver.sys+0x1600
Hook Target: driver.sys at 0xFFFFF800ABCD0000 (unsigned, suspicious)

KERNEL DRIVER ANALYSIS
[!] driver.sys - No digital signature, loaded at 0xFFFFF800ABCD0000
    Size: 45,056 bytes
    SHA-256: abc123def456...
    IRP Hooks: IRP_MJ_CREATE, IRP_MJ_DEVICE_CONTROL
    Registry: HKLM\SYSTEM\CurrentControlSet\Services\MalDriver

HIDDEN NETWORK CONNECTIONS
PID 6812: 10.1.5.42:49152 -> 185.220.101.42:443 (ESTABLISHED)
  - Not visible via netstat or user-mode tools
  - Filtered by NtDeviceIoControlFile SSDT hook

ROOTKIT CAPABILITIES
- Process hiding (DKOM + SSDT)
- File hiding (NtQueryDirectoryFile hook)
- Network connection hiding (NtDeviceIoControlFile hook)
- Kernel-mode persistence (driver service)

REMEDIATION
- Boot from clean media for offline remediation
- Remove malicious driver from offline registry
- Verify MBR/VBR/UEFI integrity for boot persistence
- Full system rebuild recommended for kernel-level compromise

ROOTKIT DETECTION ANALYSIS REPORT
====================================
Dump File:        memory.dmp
System:           Windows 10 21H2 x64
Analysis Tool:    Volatility 3.2

CROSS-VIEW DETECTION
Process List Comparison:
  pslist processes:  127
  psscan processes:  129
  [!] HIDDEN PROCESSES: 2
    PID 6784: sysmon64.exe (hidden rootkit component)
    PID 6812: netfilter.exe (hidden network filter)

SSDT HOOK ANALYSIS
[!] Entry 0x004A (NtQuerySystemInformation) hooked -> driver.sys+0x1200
[!] Entry 0x0055 (NtQueryDirectoryFile) hooked -> driver.sys+0x1400
[!] Entry 0x0119 (NtDeviceIoControlFile) hooked -> driver.sys+0x1600
Hook Target: driver.sys at 0xFFFFF800ABCD0000 (unsigned, suspicious)

KERNEL DRIVER ANALYSIS
[!] driver.sys - No digital signature, loaded at 0xFFFFF800ABCD0000
    Size: 45,056 bytes
    SHA-256: abc123def456...
    IRP Hooks: IRP_MJ_CREATE, IRP_MJ_DEVICE_CONTROL
    Registry: HKLM\SYSTEM\CurrentControlSet\Services\MalDriver

HIDDEN NETWORK CONNECTIONS
PID 6812: 10.1.5.42:49152 -> 185.220.101.42:443 (ESTABLISHED)
  - Not visible via netstat or user-mode tools
  - Filtered by NtDeviceIoControlFile SSDT hook

ROOTKIT CAPABILITIES
- Process hiding (DKOM + SSDT)
- File hiding (NtQueryDirectoryFile hook)
- Network connection hiding (NtDeviceIoControlFile hook)
- Kernel-mode persistence (driver service)

REMEDIATION
- Boot from clean media for offline remediation
- Remove malicious driver from offline registry
- Verify MBR/VBR/UEFI integrity for boot persistence
- Full system rebuild recommended for kernel-level compromise

detecting-rootkit-activity

Original

Translation

Detecting Rootkit Activity

检测Rootkit活动

When to Use

使用场景

Prerequisites

前置条件

Workflow

工作流程

Step 1: Cross-View Detection for Hidden Processes

步骤1：针对隐藏进程的交叉视图检测

Volatility: Compare process enumeration methods

Volatility: Compare process enumeration methods

pslist - walks ActiveProcessLinks (EPROCESS linked list - what rootkits manipulate)

pslist - walks ActiveProcessLinks (EPROCESS linked list - what rootkits manipulate)

psscan - scans physical memory for EPROCESS pool tags (rootkit-resistant)

psscan - scans physical memory for EPROCESS pool tags (rootkit-resistant)

Compare outputs to find hidden processes

Compare outputs to find hidden processes

Step 2: Detect System Call Hooking

步骤2：检测系统调用挂钩

Check SSDT for hooked system calls

Check SSDT for hooked system calls

Identify hooks pointing outside ntoskrnl.exe or win32k.sys

Identify hooks pointing outside ntoskrnl.exe or win32k.sys

Check for Inline hooks (detour patching)

Check for Inline hooks (detour patching)

IDT (Interrupt Descriptor Table) analysis

IDT (Interrupt Descriptor Table) analysis

Check for IRP (I/O Request Packet) hooking on drivers

Check for IRP (I/O Request Packet) hooking on drivers

Step 3: Analyze Kernel Modules and Drivers

步骤3：分析内核模块与驱动程序

List all loaded kernel modules

List all loaded kernel modules

Scan for drivers in memory (including hidden/unlinked)

Scan for drivers in memory (including hidden/unlinked)

Compare module lists to find hidden drivers

Compare module lists to find hidden drivers

Check driver signatures and verify against known-good baselines

Check driver signatures and verify against known-good baselines

Dump suspicious driver for static analysis

Dump suspicious driver for static analysis

Step 4: Detect File and Registry Hiding

步骤4：检测文件与注册表隐藏

Linux rootkit detection with rkhunter

Linux rootkit detection with rkhunter

chkrootkit scanning

chkrootkit scanning

Windows: Compare filesystem views

Windows: Compare filesystem views

Live system file listing vs Volatility filescan

Live system file listing vs Volatility filescan

Check for hidden registry keys

Check for hidden registry keys

Look for hidden services (loaded but not in service registry)

Look for hidden services (loaded but not in service registry)

Step 5: Network Connection Analysis

步骤5：网络连接分析

Memory-based network connection enumeration

Memory-based network connection enumeration

Compare with live netstat (if available) to find hidden connections

Compare with live netstat (if available) to find hidden connections

Hidden connections: present in memory but not shown by netstat

Hidden connections: present in memory but not shown by netstat

Look for raw sockets (often used by rootkits for covert communication)

Look for raw sockets (often used by rootkits for covert communication)

Check for network filter drivers (NDIS hooks)

Check for network filter drivers (NDIS hooks)

Analyze callback routines registered by drivers

Analyze callback routines registered by drivers

Step 6: Integrity Verification

步骤6：完整性验证

Check kernel code integrity (compare in-memory kernel to on-disk copy)

Check kernel code integrity (compare in-memory kernel to on-disk copy)

Compare SHA-256 of dumped ntoskrnl.exe with known-good copy

Compare SHA-256 of dumped ntoskrnl.exe with known-good copy

Windows: System File Checker (on live system)