rkhunter
also: rootkit hunter
rkhunter is a security tool that scans Linux systems for rootkits, backdoors, and other malicious software by checking for known attack signatures and suspicious system changes.
rkhunter (Rootkit Hunter) is a host-based intrusion detection tool that performs deep system scans to detect rootkits, worms, trojans, and other malware. It works by comparing system files against a database of known malicious signatures and checking for suspicious patterns in system configuration.
The tool examines critical areas including /bin, /sbin, /usr/bin, kernel modules, and system configuration files. It can verify file integrity, check for hidden processes, scan for vulnerable setuid files, and inspect network interfaces for promiscuous mode—all signs of potential compromise.
Example usage: rkhunter --check --skip-keypress performs a complete system scan and reports findings. rkhunter --update refreshes the malware signature database. Output identifies suspicious files and provides risk levels, helping administrators identify and investigate potential security threats.