Attacks and malware
What is Rootkit?
Malware that hides itself and other malicious activity by tampering with the operating system, so normal tools cannot see the infection.
A rootkit is malware designed to hide: it modifies the operating system so that its files, processes, network connections or registry keys do not appear to normal tools. Some run in user space, others in the kernel or even in firmware.
Because the infected system lies about its own state, rootkits are often found from outside: by comparing what the system reports against a memory image, network traffic or a trusted boot of another operating system.