domains / families / security / analyzing-bootkit-and-rootkit-samples

analyzing-bootkit-and-rootkit-samples

separate

'Analyzes bootkit and advanced rootkit malware infecting the Master

When to use

• A system shows signs of compromise that persist through OS reinstallation
• Antivirus and EDR are unable to detect malware despite clear evidence of compromise
• UEFI Secure Boot has been disabled or shows integrity violations
• Memory forensics reveals rootkit behavior (hidden processes, hooked system calls)
• Investigating nation-state level threats known to deploy bootkits (APT28, APT41, Equation Group)

When not to use

• standard user-mode malware

Skill page

Source