By the definition of rootkit they likely have full control of your system all the way down at the lowest levels, and therefore any commands you run to "check" for a rootkit may themselves be compromised and returning you faulty data.
Traditional ways may be to hash every file on the system and diff them with a known good system and see what system files don't match.
A lot of things happen in memory now though so you may need to do a memory dump and compare the contents of currently running processes and libraries with known good copies ... and comparing what is in memory for a process to what is on disk for that same process.
Also at a driver or boot level similar validity checks may need to be performed.
Another option is analyzing network traffic leaving the system and seeing where it's coming from. For example, if Windows Explorer is talking to Russian IPs you may have found your rootkit.
In summary though if a rootkit is found or suspected there is generally no 100% solid way to remove them ... instead the system will likely need to be rebuilt.