Which technique is commonly used by rootkits to evade detection?

• A. Overwriting the MBR to persist
• B. Using plain text passwords
• C. Disabling the firewall
• D. Kernel-mode hooks that intercept OS calls

Answer: (D)

Rootkits commonly evade detection by operating at the kernel level and using kernel-mode hooks to intercept OS calls. When a rootkit places hooks in the kernel, it can modify or suppress the data that security tools rely on—such as lists of running processes, files in a directory, registry keys, or active network connections. Because these hooks sit inside the core system, they can change the perceived state of the machine for anything that reads those OS data structures, making the rootkit and even other malicious components harder to spot. This direct control over how the operating system reports its own state is a highly effective and widely used evasion technique.

Persistence tricks like overwriting the master boot record are about surviving reboots rather than concealing presence during normal operation, so they don’t explain evasion in the same way. Using plain text passwords is a poor security practice and not an evasion mechanism. Disabling the firewall might help in some attacks, but it’s a broad action rather than a targeted method to hide the rootkit within the system’s reported state, which is why kernel-mode hooking is the strongest fit for evasion.