2023/12/13 Council Agenda Packet

What Is a Rootkit? How to Defend and Stop Them? l Fortinet https://www.fortinet.com/resources/cyberglossary/rootkit#:-':text=... camouflage themselves within a user's system. As a result, antivirus solutions that can perform rootkit scans are often required to discover the malware. Rootkit scans search for known attack signatures. One way they go about finding malware is through memory dump analysis, which discovers the instructions that a rootkit executes in a machine's memory. Another method rootkit scans use is behavioral analysis, which searches for rootkit-like behaviors rather than the rootkit itself. This method is capable of alerting users to the presence of a rootkit before they become aware that they are under attack. t sit rot ction -n Rootkits are one of the most difficult malware programs to remove from infected machines. As a result, there is no guaranteed method for recovering a machine infiltrated by a rootkit, but there are steps that users and organizations can take to protect their computers and remove the malware. va Once a rootkit has been detected, the following process should be followed to remove it: 1. Back up vital data: The rootkit's reaction upon removal is unpredictable, and it may have defensive measures built in that could affect or damage the machines performance. Back up any important data and files that need to be retained from the machine. 2. Boot up in safe mode: Many rootkits attempt to prevent a user from installing security solutions or removing the malware. In this case, restart the machine in safe mode with networking to limit the rootkit's access by pressing F8 in the Windows boot screen. 3. Use multiple rootkit scan tools: The wide range of rootkit families means that not all rootkit scans will be capable of discovering them. It is therefore important to use a combination of scanners that offer different capabilities. 4. Freeze remainingmalware: Removing the rootkit alone may not always guarantee that the machine is clean. It may have been infected by other malware that remains active or designed to evade rootkit scans. Other security solutions can freeze any malware that remains on the system, which enables malware removal programs to clean up any malicious software. 5. Advanced rootkit removal: Some rootkit types are particularly difficult to remove. For example, a firmware or hardware rootkit is unlikely to be removed by standard rootkit scans, and the user may need to back up and wipe their data from the machine and reinstall the OS. However, in the case of a rootkit targeting the BIOS, even a wipe and a reinstall may not be enough to remove the malicious software. This may require the BIOS drive to be wiped and replaced along with a hard reset of the machine. 5 of 11 12/17/2021 6• 1 R PM