Threat Explainers · 6 min read
What Is a Rootkit and How Is One Detected?
A rootkit is not a threat category by behaviour — it is a concealment technique. It hides other malicious components from the operating system itself.
Published 2026-08-09 · Last updated 2026-08-09
How concealment works
By loading early and intercepting the calls that list files, processes, registry keys and network connections, a rootkit removes its own components from the answers Windows gives — including to security software running on that same system.
Why offline scanning is the answer
If the running operating system is lying, you scan without it. Microsoft Defender Offline and vendor rescue media boot outside Windows, so the hidden components are just ordinary files on disk.
Modern protections that make rootkits harder
Secure Boot, driver signature enforcement, HVCI and hypervisor-protected features have made kernel-level persistence far more difficult on modern Windows systems — one of the strongest arguments for keeping those features enabled.
When to reinstall
If a rootkit is confirmed, a clean installation is the recommended remedy. Removal can leave a damaged system, and no scan can prove the absence of something built specifically to hide.
Frequently asked questions
- Can antivirus remove a rootkit?
- Sometimes, especially from an offline or rescue scan. For confirmed kernel-level infection, a clean Windows installation is the safer choice.
- Are rootkits common on home PCs?
- No. They are rare compared with adware, infostealers and phishing, and modern boot protections have reduced them further.