What defense is most effective against kernel-level rootkits that intercept system calls?

• A. Antivirus software
• B. Network firewall
• C. Kernel integrity monitoring (e.g., HVCI)
• D. Password policy enforcement

Answer: (C)

Intercepting system calls happens when a threat gains control at the kernel level and alters the paths the OS uses to perform privileged operations. The strongest defense here is kernel integrity monitoring, which continuously verifies that the kernel code and critical data structures (like the system call table) remain unchanged and that only trusted code runs in kernel mode. Technologies such as Hypervisor-protected Code Integrity (HVCI) use a hypervisor to enforce this trust boundary, preventing unauthorized kernel drivers or modules from loading or modifying the syscall mechanism. Because the attack unfolds inside the kernel, defenses that operate at higher levels—like antivirus software, network firewalls, or password policies—do not directly prevent or detect these kernel-level alterations and can be bypassed or irrelevant to this specific threat.