## Hunting Rootkits & Hidden Processes

**Rootkits** are the ninjas of malware. They modify the Kernel (Ring 0) to intercept the reality presented to the OS.

### Direct Kernel Object Manipulation (DKOM)
*   Windows keeps a list of processes in a Doubly Linked List (ActiveProcessLinks).
*   Task Manager iterates this list to show you what runs.
*   **The Attack**: A Rootkit simply "unlinks" its process node from the list.
    *   Previous -> Next.
    *   It literally disconnects itself.
    *   The OS still schedules CPU time for it (because the Scheduler uses a different list), so it runs. But tools (TaskMgr, Sysinternals) that rely on the API list cannot see it.

### Hunting with Cross-View Analysis
The technique of comparing different "views" of the system to find lies.
*   **View 1**: The API List (`pslist`). (Modified by Rootkit).
*   **View 2**: The Scheduler / Thread List (`thrdscan`). (Harder to modify without crashing).
*   **View 3**: CSRSS Handles (`handles`).
*   **Method**: `psscan` (Volatility) scans the raw physical RAM for structures that *look* like processes (EPROCESS blocks).
    *   If `psscan` finds it, but `pslist` misses it -> **Rootkit Confirmed**.

### Hooks (SSDT Hooking)
*   **SSDT (System Service Descriptor Table)**: The map of System Calls.
*   **Attack**: Malicious driver overwrites the address of `NtQuanryDirectoryFile`.
    *   Original: Points to `ntoskrnl.exe`.
    *   Hooked: Points to `evil_rootkit.sys`.
*   When you ask for a file list, the Rootkit code runs first, filters the results, and then passes the request to the real Kernel.
*   **Detection**: **`ssdt`** plugin in Volatility checks if any function pointer points outside the valid Kernel memory range.