The correct answer is Rootkit.

Rootkit technology typically embeds at the kernel or firmware level and can hook system calls or modify boot components which lets it hide files processes and network activity from endpoint defenses. Because it operates below the normal visibility of the operating system signature and behavioral detection are frequently evaded. Detection often requires offline analysis memory forensics or hardware based integrity checks so it is usually the hardest for host based defenses to discover.

Rootkit variants that live in the bootloader firmware or hypervisor can persist across reboots and remain invisible to standard antivirus which generally inspects user space or relies on the operating system for visibility.

Trojan horse is typically user level malware that relies on social engineering to run and it leaves artifacts and behaviors that endpoint protection and reputation systems can detect.

Cryptominer commonly causes noticeable CPU GPU and network usage and it usually runs in user space so monitoring and heuristics make it easier to find than a rootkit.

Worm self propagates across networks and creates observable scanning and infection patterns which network and host sensors can detect more reliably than the stealth techniques used by rootkits.

Full AWS Practitioner Certification Question