The primary objective of a rootkit is to conceal its presence and the activities of other malicious software on a compromised system. A fundamental technique to achieve this is by modifying the host operating system or its utilities. By replacing legitimate programs (e.g., ls, ps, netstat on Linux, or system DLLs on Windows) with trojanized versions, the rootkit can manipulate the information presented to the user or system administrator. This allows it to hide malicious files, processes, and network connections, thereby maintaining persistent and undetected access for the attacker.

A. This describes a backdoor. While a rootkit is often used to hide a backdoor, its primary function is concealment, not providing the unauthorized service itself.
B. A buffer overflow is an exploit or vulnerability used to gain initial access or escalate privileges, which typically occurs before a rootkit is installed.
D. This is another description of a backdoor. A rootkit's main purpose is to hide such an opening, not to be the opening itself. ---

1. University Courseware:

Wagner

D. (2018). CS 161: Computer Security

Lecture 18: Malware. University of California

Berkeley. In the section on "Rootkits

" the lecture notes state

"User-level rootkits: Modify executables. E.g.

replace /bin/ls with a version that doesn’t show the attacker’s files." This directly supports the concept of replacing legitimate programs as a core rootkit function. (Available through UC Berkeley's course materials).

2. Peer-reviewed Academic Publications:

Al-Rawi

A. K.

& Al-Shaikhli

I. F. (2013). A Survey on Rootkit Detection Techniques. Journal of Information Security

4(3)

155-165. In Section 2

"Rootkit Classification

" the paper describes User-Mode Rootkits: "This type of rootkit modifies the behavior of the operating system by replacing original system executables and libraries with the modified ones." (DOI: 10.4236/jis.2013.43018

Page 156).

3. Official Vendor/Standards Documentation (NIST):

Souppaya

M.

& Scarfone

K. (2013). NIST Special Publication 800-83 Rev. 1: Guide to Malware Incident Prevention and Handling for Desktops and Laptops. National Institute of Standards and Technology. Section 2.3.6 defines a rootkit as a tool to "conceal the attacker’s activities" and notes that they achieve this by "modifying parts of the operating system

" which includes replacing executables. (Page 2-4).