Detection: Cross-View (the core idea)

Since rootkits lie through the normal API, compare that answer to a

ground truth the rootkit did not filter.

• Tools: GMER, Rootkit Revealer used this file/registry cross-view.
• Anything present in the raw view but missing from the API view is suspicious by construction.