rkhunter

rkhunter is a tool designed to detect rootkits, backdoors, sniffers, and exploits on Linux systems. It performs comprehensive scans to identify signs of compromise by examining various system artifacts that could indicate malicious activity.

Use cases include routine security audits, incident response, and system hardening. Administrators can run it to verify system integrity, especially after suspected breaches or as part of regular maintenance. It is particularly useful for detecting persistence mechanisms like rootkits that hide malicious processes or files.

Note that using rkhunter alone does not guarantee a system is not compromised. It is recommended to run additional tests, such as chkrootkit, for more thorough verification.

rkhunter checks SHA256 hash changes to detect modified files, scans for files commonly created by rootkits, inspects executables for anomalous file permissions, looks for suspicious strings in kernel modules, identifies hidden files in system directories, and can optionally scan within files for malicious content. It supports package managers like DPKG to verify file properties and maintains a database of known good hashes updated via --propupd.