GREM GREM Rootkit & Anti-Forensics Analysis

Question 1

What fundamentally distinguishes a kernel-mode rootkit from a user-mode rootkit?

Accepted Answer

Kernel-mode rootkits operate at CPU Ring 0 with unrestricted access, while user-mode rootkits operate at Ring 3

Answer

Kernel-mode rootkits execute at CPU Ring 0, giving them unrestricted access to all hardware and memory, making them far more powerful and harder to detect than user-mode rootkits at Ring 3.

Question 2

What is DKOM (Direct Kernel Object Manipulation) used for by rootkits?

Accepted Answer

Hiding processes by unlinking their EPROCESS entries from the kernel's doubly linked process list

Answer

DKOM rootkits directly manipulate kernel data structures such as the EPROCESS linked list to unlink hidden processes, making them invisible to OS APIs and standard task managers.

Question 3

How do SSDT hook-based rootkits intercept information returned to user-mode programs?

Accepted Answer

They overwrite entries in the System Service Descriptor Table to redirect system calls to malicious handler functions

Answer

SSDT hook rootkits overwrite function pointers in the System Service Descriptor Table so that system calls are redirected to the rootkit's code, which can filter or falsify results.

Question 4

Which open-source tool cross-references multiple process listing sources to detect hidden processes that kernel rootkits conceal?

Accepted Answer

Process Hacker (System Informer)

Answer

Process Hacker (now System Informer) queries multiple lower-level APIs and kernel structures simultaneously to detect discrepancies that reveal rootkit-hidden processes.

Question 5

What type of rootkit infects the Master Boot Record to execute before the operating system loads?

Accepted Answer

Bootkit

Answer

A bootkit infects the MBR or boot sector so it executes before OS load, giving it control over the boot chain and allowing persistence even after OS reinstallation.

(GREM) Giac Reverse Engineering Malware Practice Test

(GREM) Giac Reverse Engineering Malware Practice Test

GREM GREM Rootkit & Anti-Forensics Analysis