Rootkits

A rootkit compromises the layer that reports on the system, so the system's own answers stop being trustworthy.

Processes do not appear in the list, files do not appear in the directory, connections do not appear in the table. Investigating from the machine itself becomes unreliable, which is why examining a disk externally or comparing against network-observed behaviour matters when one is suspected.