Which rootkit type acts as a hypervisor and modifies the boot sequence to load the host OS as a virtual machine?

Which rootkit type acts as a hypervisor and modifies the boot sequence to load the host OS as a virtual machine?

• A. Hypervisor Level Rootkit
• B. Hardware/Firmware Rootkit
• C. Kernel Level Rootkit
• D. Boot Loader Level Rootkit

Answer: (A)

Hypervisor level rootkit This type sits between the hardware and the operating system, introducing a virtualization layer at the very start of the boot process. By modifying the boot sequence to start a hypervisor first, the real operating system ends up running as a guest inside that hypervisor. This gives the attacker pervasive control and a stealthy vantage point, because most activities and I/O go through the hypervisor, making detection inside the OS extremely difficult. In contrast, other rootkit types operate at different layers: hardware/firmware targets firmware like BIOS/UEFI or other hardware components; kernel level hooks into the OS kernel; and boot loader level replaces or patches the bootloader to load code before the OS, without establishing a virtualization layer.

Hypervisor level rootkit

This type sits between the hardware and the operating system, introducing a virtualization layer at the very start of the boot process. By modifying the boot sequence to start a hypervisor first, the real operating system ends up running as a guest inside that hypervisor. This gives the attacker pervasive control and a stealthy vantage point, because most activities and I/O go through the hypervisor, making detection inside the OS extremely difficult.

In contrast, other rootkit types operate at different layers: hardware/firmware targets firmware like BIOS/UEFI or other hardware components; kernel level hooks into the OS kernel; and boot loader level replaces or patches the bootloader to load code before the OS, without establishing a virtualization layer.