CEH Enumeration and System Hacking Practice Question
A forensic analyst discovers that an attacker used a rootkit to hide malicious processes and files on a compromised Linux system. The rootkit also intercepts system calls to `open()` and `stat()` to return clean results. Which of the following techniques is the rootkit using to cover its tracks?
⚠ Common exam trap
Many candidates confuse syscall hooking with log manipulation or steganography, not realizing that the question specifically describes intercepting system calls to return clean results, which is the hallmark of kernel-level rootkit hiding, not file-level or log-level concealment.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Syscall hooking to modify the return values of userland commands
The rootkit intercepts system calls like `open()` and `stat()` to return clean results, which is a classic example of syscall hooking. By hooking these kernel-level functions, the rootkit can filter out any information about its own malicious files and processes, making them invisible to userland commands such as `ls`, `ps`, or `cat`. This technique operates at the kernel level, not in user space, allowing it to control what data is returned to any process that makes those syscalls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Steganography to conceal malicious files in image metadata
Why it's wrong here
Steganography involves embedding data, such as malicious files or code, within other seemingly innocuous files like images or audio, often in their metadata or least significant bits. While effective for initial concealment and exfiltration of data, steganography does not provide the runtime stealth required for an active rootkit to operate undetected. It does not intercept or modify system calls to prevent utilities like `ls` or `ps` from revealing the rootkit's processes or files once they are active and running on the system.
- ✗
Token impersonation to gain administrator privileges
Why it's wrong here
Token impersonation is a Windows-specific privilege escalation technique where an attacker steals or duplicates an access token from a highly privileged process or user session. This allows the attacker's process to execute with the stolen privileges, effectively gaining administrator or system-level access. However, this technique solely focuses on elevating privileges and does not inherently provide mechanisms to conceal the presence of malicious files, processes, or network connections from system monitoring tools, which is the primary function of a rootkit's stealth component.
- ✓
Syscall hooking to modify the return values of userland commands
Why this is correct
Syscall hooking is a sophisticated technique employed by kernel-mode rootkits to achieve stealth by intercepting and modifying the behavior of system calls. When userland commands like `ls`, `ps`, or `netstat` attempt to query system information (e.g., `open()`, `read()`, `stat()`, `getdents()`), the rootkit's hook diverts these calls to its own code. It then filters out any references to its own files, processes, or network connections before returning manipulated, "clean" data to the calling application, effectively making its presence invisible to standard system utilities.
- ✗
Log manipulation by clearing entries in /var/log
Why it's wrong here
Log manipulation, such as clearing entries in `/var/log` or modifying specific log files, is a common post-exploitation activity aimed at covering an attacker's tracks. While crucial for forensic evasion by removing evidence of past actions, this is a user-level action performed after the fact and does not provide real-time operational stealth for an active rootkit. A rootkit's primary stealth mechanism involves operating at the kernel level to prevent system utilities from even *seeing* its components in the first place, rather than simply cleaning up evidence of its past actions.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.