Which rootkit is characterized by its function of adding code and/or replacing some of the operating-system kernel code to obscure a backdoor on a system?
A Kernel-level rootkit operates at the core of the operating system (OS kernel), enabling the attacker to:
Modify or replace kernel code
Load malicious kernel modules
Hide files, processes, and backdoors at a level that is difficult for standard security tools to detect
According to CEH v13:
Kernel-mode rootkits are highly stealthy and dangerous because they run with the highest privileges.
These rootkits modify system calls and memory structures in the kernel space to conceal malicious activity.
Incorrect Options:
A. User-mode rootkits operate at the application layer and are less stealthy than kernel-level rootkits.
B. Library-level rootkits manipulate standard libraries (like libc) to intercept calls.
D. Hypervisor-level rootkits run beneath the OS (e.g., via virtualization) and are extremely rare and complex.
Reference – CEH v13 Official Courseware:
Module 06: Malware Threats
Section: “Types of Rootkits”
Subsection: “Kernel-Mode Rootkits vs. User-Mode Rootkits”
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit