Which of the following threats changes system functionality at the operating system level for a malicious purpose by gaining administrative access after being installed by a user?

A botnet is a network of compromised machines controlled remotely by an attacker for tasks like spam or DDoS, but the term does not describe the OS-level modification mechanism.

A Trojan disguises itself as legitimate software to trick users into installing it but does not specifically describe OS-level functionality modification or privilege escalation by design.

A worm self-replicates and spreads across networks without user interaction but does not specifically target OS-level system functionality or administrative access.

Rootkits are installed by a user (often unknowingly via a Trojan or compromised installer) and then modify the operating system at a fundamental level to conceal malicious processes, files, and network connections from security tools. They escalate to administrative or root privileges to maintain persistent, hidden control over the compromised system.