Which rootkit technique locates and patches the system memory to hide from detection?

Which rootkit technique locates and patches the system memory to hide from detection?

• A. Direct kernel object manipulation (DKOM) rootkits
• B. Hypervisor-based rootkits
• C. Userland rootkits
• D. Bootkit rootkits

Answer: (A)

Direct kernel object manipulation glides into the kernel and patches memory-resident data structures the OS uses to track its own objects—like process lists, file tables, or hooks. By locating these kernel objects in memory and changing their fields or pointers, a rootkit can effectively hide processes, files, or other indicators from detection tools that enumerate kernel structures. This in-memory manipulation in kernel mode makes the rootkit stealthy, because it alters the very information security tools rely on to spot malicious activity, without needing to alter disk files or boot code. Other approaches operate differently: a hypervisor-based rootkit sits beneath the OS in a virtualization layer and intercepts OS calls from the outside, not by patching kernel memory directly. Userland rootkits run in regular user mode and don’t have reliable access to kernel memory structures, making them easier to detect. Bootkit rootkits alter the boot process to load early, focusing on persistence across boots rather than hiding in-memory kernel objects during normal operation. So, the technique of locating and patching kernel memory to hide from detection is best described by direct kernel object manipulation rootkits.

Direct kernel object manipulation glides into the kernel and patches memory-resident data structures the OS uses to track its own objects—like process lists, file tables, or hooks. By locating these kernel objects in memory and changing their fields or pointers, a rootkit can effectively hide processes, files, or other indicators from detection tools that enumerate kernel structures. This in-memory manipulation in kernel mode makes the rootkit stealthy, because it alters the very information security tools rely on to spot malicious activity, without needing to alter disk files or boot code.

Other approaches operate differently: a hypervisor-based rootkit sits beneath the OS in a virtualization layer and intercepts OS calls from the outside, not by patching kernel memory directly. Userland rootkits run in regular user mode and don’t have reliable access to kernel memory structures, making them easier to detect. Bootkit rootkits alter the boot process to load early, focusing on persistence across boots rather than hiding in-memory kernel objects during normal operation.

So, the technique of locating and patching kernel memory to hide from detection is best described by direct kernel object manipulation rootkits.