By definition, a rootkit does which of the following?

Appearing as useful software until activated describes a Trojan horse, which disguises malicious functionality inside a seemingly legitimate application.

Rootkits operate by hooking into OS kernel functions or modifying system data structures to hide their own presence, making infected processes invisible to task managers, antivirus scanners, and file browsers. This concealment allows attackers to maintain a persistent, privileged backdoor on the compromised system without detection. The name 'rootkit' derives from 'root' (administrator-level access) and 'kit' (a collection of tools to maintain that access covertly).

Replicating by copying itself to another program is the defining characteristic of a computer virus, not a rootkit.

Self-propagating across computers using network transport protocols describes a worm, which spreads autonomously without requiring a host program.