I'm not sure if you're serious, or if you even know what you're talking about.

Rings go from 0 to 3, so either you're looking for the fourth one (which would be ring 3) or the first one (which would be ring 0). Making a rootkit for ring 3 would be quite pointless, and making it for ring 0 would be quite difficult. I've never encountered any 0-day vulnerabilities for kernel level applications, especially not any exploits.

So assuming you don't have access to any relevant exploits, I won't help you. But I'm pretty sure you were aware of that already, which brings me to this question; why even ask?