Which rootkit type replaces the original OS kernel and device driver codes?

Which rootkit type replaces the original OS kernel and device driver codes?

• A. Hypervisor Level Rootkit
• B. Library Level Rootkits
• C. Kernel Level Rootkit
• D. Hardware/Firmware Rootkit

Answer: (C)

Replacing the original OS kernel and device driver codes is the hallmark of a kernel-level rootkit. This type operates at the highest privilege level by substituting or patching the core kernel and its drivers, giving the attacker control over fundamental OS operations. With the kernel in control, it can hook or modify system calls, hide files and processes, alter networking behavior, and persist across reboots by tampering with kernel modules or boot components. In contrast, hypervisor-level rootkits reside in a virtualization layer above the OS and intercepts operations without necessarily replacing the kernel and drivers; library-level rootkits target user-space libraries and processes rather than the kernel, and hardware/firmware rootkits embed in firmware or hardware rather than modifying the OS kernel directly. Hence, modifying the kernel and device drivers identifies this as kernel-level.

Replacing the original OS kernel and device driver codes is the hallmark of a kernel-level rootkit. This type operates at the highest privilege level by substituting or patching the core kernel and its drivers, giving the attacker control over fundamental OS operations. With the kernel in control, it can hook or modify system calls, hide files and processes, alter networking behavior, and persist across reboots by tampering with kernel modules or boot components.

In contrast, hypervisor-level rootkits reside in a virtualization layer above the OS and intercepts operations without necessarily replacing the kernel and drivers; library-level rootkits target user-space libraries and processes rather than the kernel, and hardware/firmware rootkits embed in firmware or hardware rather than modifying the OS kernel directly. Hence, modifying the kernel and device drivers identifies this as kernel-level.