Lion Cipher Lab
Detect a rootkit by contradiction: when the live system and the forensic image disagree
- Digital Forensics & IR (DFIR)
- Advanced
- ~50 min
- Free · no account required
Why it matters
A rootkit is the one class of malware built specifically to defeat the tools you would normally use to find it. It hides its process from Task Manager, its files from Explorer, its network connection from netstat, and often its own driver from the service list -- and it does this by sitting between those tools and the truth, intercepting the questions and editing the answers on the way back. That means the single most natural instinct in incident response -- 'log in and look around' -- is exactly the instinct a rootkit is engineered to fool. The professional counter is not a cleverer on-host…
What you'll learn
- understanding cross-view (difference-based) detection: comparing a trusted independent view against the OS's own answer to reveal what a rootkit hides
- reading a live tasklist against a Volatility psscan to surface a process hidden by DKOM
- reading a live directory listing against a forensic (Sleuth Kit fls) view of the same disk to surface a hidden file
- reading a live netstat against a packet capture taken off a network tap to surface a hidden C2 connection
- reading a live driverquery against a Volatility driverscan to surface a hidden kernel driver
- explaining hooking and DKOM at a concept level -- why the on-host tools lie in the first place
- tying four independent discrepancies back to a single rootkit component
- judgment: WHEN cross-view comparison is the only reliable detection, WHY off-host forensics beats live tools on a rooted host, and HOW a pro acquires an independent view
Steps in this lab
- What a rootkit is, and why the machine's own tools lie
- The one big idea: you cannot trust the patient to examine itself
- How a pro gets an honest view: acquire off-host, before you look
- Contradiction 1 -- the hidden PROCESS: live tasklist vs Volatility psscan
- Contradiction 2 -- the hidden FILE: live dir vs a forensic disk view (Sleuth Kit fls)
- Contradiction 3 -- the hidden CONNECTION: live netstat vs a packet capture
- Contradiction 4 -- the hidden DRIVER: live driverquery vs Volatility driverscan
- Read all four as one rootkit -- and corroborate before you conclude
- The rule to carry: never let the patient examine itself