Procedure examples

Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.

MEDUSA is a rootkit with command execution and credential logging capabilities.

COATHANGER hooks or replaces multiple legitimate processes and other functions on victim devices.

Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.

Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().

Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.

Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.

Line Dancer can hook both the crash dump process and the Autehntication, Authorization, and Accounting (AAA) functions on compromised machines to evade forensic analysis and authentication mechanisms.

REPTILE has the ability to hook kernel functions and modify functions data to achieve rootkit functionality such as hiding processes and network connections.

Zeroaccess is a kernel-mode rootkit.

Caterpillar WebShell has a module to use a rootkit on a system.

Uroburos can use its kernel module to prevent its host components from being listed by the targeted system's OS and to mediate requests between user mode and concealed components.

Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.

Hikit is a Rootkit that has been used by Axiom.

Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.

PoisonIvy starts a rootkit from a malicious file dropped to disk.

LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.

Ramsay has included a rootkit to evade defenses.

Carberp has used user mode rootkit techniques to remain hidden on the system.

Ebury acts as a user land rootkit using the SSH service.

HIDEDRV is a rootkit that hides certain operating system artifacts.

HiddenWasp uses a rootkit to hook and implement functions on the system.

WarzoneRAT can include a rootkit to hide processes, files, and startup.

HTRAN can install a rootkit to hide network connections from the host OS.