Which rootkit technique locates and manipulates the 'system' process in kernel memory structures to patch it?

Which rootkit technique locates and manipulates the 'system' process in kernel memory structures to patch it?

• A. Direct kernel object manipulation (DKOM) rootkits
• B. Kernel object patching rootkits
• C. System process hijacking rootkits
• D. Memory-resident rootkits

Answer: (A)

Direct Kernel Object Manipulation involves finding the system’s kernel object in memory and changing its fields to alter how the system treats that object. In Windows, the System process is a kernel-space process represented by a kernel object in memory (the EPROCESS structure). A rootkit using this technique locates that System process object and patches it—modifying fields such as pointers or attributes that govern its behavior—so the kernel’s view of the System process is altered. By manipulating this kernel object directly, the rootkit can patch the System process itself to hide activity, bypass checks, or ensure persistence, without relying on user-mode code or hooking routines. The description matches this approach precisely: locating the System process in kernel memory and patching it to change how the system operates. Other methods might involve different persistence or stealth tricks, but they don’t describe directly modifying the kernel object that represents the System process.

Direct Kernel Object Manipulation involves finding the system’s kernel object in memory and changing its fields to alter how the system treats that object. In Windows, the System process is a kernel-space process represented by a kernel object in memory (the EPROCESS structure). A rootkit using this technique locates that System process object and patches it—modifying fields such as pointers or attributes that govern its behavior—so the kernel’s view of the System process is altered. By manipulating this kernel object directly, the rootkit can patch the System process itself to hide activity, bypass checks, or ensure persistence, without relying on user-mode code or hooking routines. The description matches this approach precisely: locating the System process in kernel memory and patching it to change how the system operates. Other methods might involve different persistence or stealth tricks, but they don’t describe directly modifying the kernel object that represents the System process.