CyberGuard dictionary / Malware
Rootkit
A rootkit is software or a set of techniques used to conceal malicious presence or activity by changing what a system reports to defenders.
In simple terms
A rootkit tries to hide files, processes, connections, or other signs of compromise.
Technical explanation
It may intercept operating-system calls at user, kernel, boot, or lower layers to alter observations. Rootkit detection can require trusted external tools or offline analysis because the compromised system may misreport its own state.
A rootkit may hide processes, files, or activity by altering low-level system behavior. Because the compromised operating system may give unreliable evidence, investigators may need trusted external collection and rebuilding.
Examples in practice
A compromised server hides a malicious process from ordinary process listings while it continues to make outbound connections.
A host reports no suspicious process, yet network monitoring shows periodic outbound connections. Responders boot trusted media, collect evidence, and rebuild the host from a known-good image.
Why it matters
A clean-looking local tool output cannot be assumed reliable when the host itself may be hiding activity.
VERIFY & LEARN MORE
Sources and further reading
Published 2026-10-15 · Last updated 2026-10-15 · CyberGuard editorial content. Source links provide context; they do not imply endorsement.