chkrootkit

sudo chkrootkit

Checks the system for rootkits with chkrootkit, detecting signatures and modified binaries of known rootkits.

Run it when you need the classic rootkit check: chkrootkit verifies system binaries against known rootkit signatures, looks for characteristic files and directories, and reviews processes and ports for backdoors. It is the complementary tool to rkhunter (both cover the same ground with slightly different approaches). In hardening and IR, chkrootkit is the periodic check (cron) and the on-demand check when you suspect something: a modified system binary and a known rootkit signature.

Don't use it as a verdict: chkrootkit detects known rootkits by signature — advanced rootkits (kernel mode, obfuscated, new) evade it; for those, use memory analysis and EDR. False positives exist: legitimate files and processes that match rootkit names (chkrootkit warnings require interpretation). And note: chkrootkit updates with new signatures (the distro package version may be outdated — the official repo version is the reference). On systems with many packages, the check takes time; in production, schedule it. For the modern layer, use rkhunter + memory analysis; chkrootkit is the classic check.