# Rootkits

## Four types:&#x20;

* **Userland** - Patching, Import Address Table, inline
* **Kernel -** IDT, SSDT, DKOM, Driver IRP
* **Hypervisor (bootkit)** - Boot Sector, MBR, GPT, VBR
* **Firmware / Hardware -** UEFI, Micro-controller, Hard Drive

### Userland

the simplest form of rootkit, sits in the operating system where applications and users interact (userland). involves hooking / redirecting the import address table pointers of running processes and directly patching loaded code in memory to redirect execution paths.&#x20;

Less likely to crash processes/systems than other rootkits but more vulnerable to detection. Userland hooking is also performed applications so can be difficult to detect.

**Import Address table (`IAT`)** - simplest form of usland rootkits, changes the address location in a process's IAT

**Inline/Trampoline hooks** - modify functions themselves adding a jump (or equivalent) to the malicious code

Example of legitimate hooks: `svchost`, `vmtools`, security tools, and `codemeter`/ `hasp` copy protection. DLL examples:&#x20;

* `setupapi.dll`
* `mswsock.dll`
* `sfc_os.dll`
* `adsldpc.dll`
* `advapi32.dll`
* `secu32.dll`
* `ws2_32.dll`
* `iphlpapi.dll`
* `ntdll.dll`
* `kernel32.dll`
* `user32.dll`
* `gdi32.dll`

### Kernel (DKOM)

can subvert everything running within the OS, often with simple changes. Modification of critical system tables like `IDT`, `SSDP`, `IRP` can redirect code execution and attacks like direct kernel object manipulation (`DKOM`). Very difficult to detect and can be used to unhook specific processes&#x20;

Microsoft have worked to mitigate kernel rootkit technology via `PatchGuard` and `Driver Signature Enforcement`

### Hypervisor Bootkits&#x20;

virtualisation attacks are the successor of boot sector and master boot record attacks. Hardware based features like `TPM` and `security boot technologies` prevent many of these techniques and as older systems are replaced, are very effective against bootkits.&#x20;

### Hardware/ Firmware

newest generation of rootkits that seek to limit footprint on disk to obfuscate and complicate detection. although generally rare, they are very system-dependent, and typically required more traditional rootkit techniques (like driver loading), to setup making detection still feasible.&#x20;

### Bring your own Vulnerable Driver (BYOVD)

Drivers provide the operating system kernel code (injected into kernel) to extend its functionality.

BYOVD takes advantage of flaws in existing Windows drivers  to load a secondary malicious driver (_as from Win10 1607, Microsoft enforce all drivers to be signed by them_). Services are most commonly to load drivers (forensics artifacts include, memory event logs and registry entries).&#x20;

Loldrivers was made to help investigators:\
[https://www.loldrivers.io/](https://www.loldrivers.io/)\
