rkhunter

sudo rkhunter --check

Checks the system for rootkits with rkhunter: modified binaries, hidden files, suspicious ports and modules.

Run it when you need a system rootkit check: rkhunter verifies system binaries against its hash database, looks for hidden and suspicious files, reviews ports and kernel modules, and checks known rootkit commands. It's the classic Linux rootkit detection tool: periodic review (cron) and on-demand check when suspicion arises. In IR and hardening, rkhunter is the deep compromise detection layer: the modified system binary (an ls with a backdoor) and kernel modules loaded by the attacker.

Don't use it as a definitive verdict: rkhunter detects known rootkits by signature and binary changes against its database — advanced rootkits (kernel mode, obfuscated) evade it, and an uninitialized hash database after installation (or after a legitimate update) generates massive false positives. The database is updated (rkhunter --update and --propupd) with every legitimate binary change. And watch out for noise: rkhunter warnings (hidden files, ports) require interpretation — each warning is reviewed before declaring; a warning is not a rootkit. For modern detection, EDR and memory analysis are the layer; rkhunter is the classic hygiene check.