Rootkit

PCIComplianceHubLast updated

A type of malicious software that hides its presence on a system, often by modifying operating system components or processes. Organizations must implement strong malware protection measures to detect and remove rootkits and maintain PCI DSS compliance.

Applies to. PCI DSS v4.0.1 does not name rootkits. They fall under the Requirement 5 anti-malware controls, which must detect all known types of malware and may rely on continuous behavioural analysis of systems or processes, in general terms the approach better suited to code that hides from signature scans. Because a rootkit works by altering operating system components, the change-detection mechanisms the standard counts among its critical security controls are the other place its footprint shows up.
Related. Malware, Anti-Malware, File Integrity Monitoring, Change-and-Tamper Detection Mechanism
Sources. PCI DSS v4.0.1 (June 2024)