I use tools from sysinternals for various tasks (ex. process monitor), but I'm not sure if these programs can be used to manual rootkit detection since rootkit processes can be hiden.

Are there any trusted tools which could help. I'm not looking for automated solutions software such as AV scanners, since scanners can't detect new threats, if you have reference to thechnical article that should be ok too.

  • This depends on how advanced the rootkit is. Worst case, you need to use JTAG. – forest Mar 3 '19 at 6:24

By the definition of rootkit they likely have full control of your system all the way down at the lowest levels, and therefore any commands you run to "check" for a rootkit may themselves be compromised and returning you faulty data.

Traditional ways may be to hash every file on the system and diff them with a known good system and see what system files don't match.

A lot of things happen in memory now though so you may need to do a memory dump and compare the contents of currently running processes and libraries with known good copies ... and comparing what is in memory for a process to what is on disk for that same process.

Also at a driver or boot level similar validity checks may need to be performed.

Another option is analyzing network traffic leaving the system and seeing where it's coming from. For example, if Windows Explorer is talking to Russian IPs you may have found your rootkit.

In summary though if a rootkit is found or suspected there is generally no 100% solid way to remove them ... instead the system will likely need to be rebuilt.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy