How rootkits hide services on kernel mode?


1 Answer 1


rootkit in kernel operate at the same security level as the operating system itself.
A rootkit can modify data structures in the Windows kernel using a method known as direct kernel object manipulation (DKOM)
This method can be used to hide processes. A kernel mode rootkit can also hook the System Service Descriptor Table (SSDT), or modify the gates between user mode and kernel mode, in order to cloak itself

there is various way:

  1. Using Hook Bypass Method through Mapped Image to Uncover Hidden
  2. Services Enumerating Child Processes of Services.exe to Detect
  3. Hidden Services Hidden Services Detection by Enumerating Processes with 'NtControlPipe'
  4. Hidden Service Detection by Enumerating Services Registry Key

Not the answer you're looking for? Browse other questions tagged or ask your own question.