About this interactive
What you are doing: deciding whether each case shows a rootkit at work.
The lesson’s point: a rootkit is a suite of software tools that reaches the root user, the escalated privilege that controls the back end of the system, and bypasses the device’s security measures. In an attacker’s hands it is used to escalate privileges and keep control without being seen. In Security+ and NIST usage that pairing is the mark of a rootkit: root-level control, kept hidden.
How to use it: look for both. Escalated, root-level control and concealment from the owner or the security tools mean a rootkit. Code that runs with an ordinary user’s rights and is plain to see is other malware. A wrong answer resets your streak.
What you'll learn
- Recognize a rootkit at work by its two marks: it gives an attacker root-level, escalated control of a device and hides that control from the owner and the security tools
- Tell a rootkit from malware that runs with an ordinary user’s rights and does nothing to conceal itself
Aligned to
CompTIA Security+
2.4
Given a scenario, analyze indicators of malicious activity.
Key terms
- Rootkit
- Software that grants unauthorized privileged access to areas of a system, often used to conceal malicious activity.
- Privilege Escalation
- An attack that exploits vulnerabilities to gain higher-level access than originally authorized.
- Malware
- Software specifically designed to disrupt, damage, or gain unauthorized access to a system.
Topics
Rootkit
Privilege Escalation
Interactive
Streak Sort
About TechKnowSurge
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →