Rootkits
Four types:
Userland - Patching, Import Address Table, inline
Kernel - IDT, SSDT, DKOM, Driver IRP
Hypervisor (bootkit) - Boot Sector, MBR, GPT, VBR
Firmware / Hardware - UEFI, Micro-controller, Hard Drive
Userland
the simplest form of rootkit, sits in the operating system where applications and users interact (userland). involves hooking / redirecting the import address table pointers of running processes and directly patching loaded code in memory to redirect execution paths.
Less likely to crash processes/systems than other rootkits but more vulnerable to detection. Userland hooking is also performed applications so can be difficult to detect.
Import Address table (IAT) - simplest form of usland rootkits, changes the address location in a process's IAT
Inline/Trampoline hooks - modify functions themselves adding a jump (or equivalent) to the malicious code
Example of legitimate hooks: svchost, vmtools, security tools, and codemeter/ hasp copy protection. DLL examples:
setupapi.dllmswsock.dllsfc_os.dlladsldpc.dlladvapi32.dllsecu32.dllws2_32.dlliphlpapi.dllntdll.dllkernel32.dlluser32.dllgdi32.dll
Kernel (DKOM)
can subvert everything running within the OS, often with simple changes. Modification of critical system tables like IDT, SSDP, IRP can redirect code execution and attacks like direct kernel object manipulation (DKOM). Very difficult to detect and can be used to unhook specific processes
Microsoft have worked to mitigate kernel rootkit technology via PatchGuard and Driver Signature Enforcement
Hypervisor Bootkits
virtualisation attacks are the successor of boot sector and master boot record attacks. Hardware based features like TPM and security boot technologies prevent many of these techniques and as older systems are replaced, are very effective against bootkits.
Hardware/ Firmware
newest generation of rootkits that seek to limit footprint on disk to obfuscate and complicate detection. although generally rare, they are very system-dependent, and typically required more traditional rootkit techniques (like driver loading), to setup making detection still feasible.
Bring your own Vulnerable Driver (BYOVD)
Drivers provide the operating system kernel code (injected into kernel) to extend its functionality.
BYOVD takes advantage of flaws in existing Windows drivers to load a secondary malicious driver (as from Win10 1607, Microsoft enforce all drivers to be signed by them). Services are most commonly to load drivers (forensics artifacts include, memory event logs and registry entries).
Last updated