Linux Stealth Rootkit Hunting with Command Line Forensics

Linux虽安全，但易受rootkit等恶意软件攻击。 可使用Chkrootkit和Linux Malware Detect等开源工具扫描检测。 Chkrootkit简单检测，LMD功能全面且定期更新。 配置后能自动扫描、监控并报警。

Chkrootkit is a popular security scanner that helps administrators look for signs when a system is infected with rootkits. You can use chkrootkit to find files and rules associated with rootkits, but you cannot be 100% sure that all rootkits will be found

Rootkits are malicious tools attackers install to keep persistent, stealthy access to a compromised system. Regular rootkit scanning is an essential part of server security hygiene — especially for cloud servers that run public services.

chkrootkit是一款用于检测系统是否被rootkit入侵的工具，本文将详细介绍如何在CentOS系统中使用chkrootkit进行入侵检测与防御。

Lynisis a free, open-source, powerful, and popular security auditing and scanning tool for Unix/Linux-like operating systems. It is a malware scanning and vulnerability detecting tool that scans systems for security information and issues, file integrity,

Rootkit Hunter (rkhunter) is a Unix-based tool that scans for rootkits, backdoors and possible local exploits. Rootkits are self-hiding toolkits secretly installed by a malicious intruder to allow that user to gain access to the server.

chkrootkit （Check Rootkit）是一个开源的 Rootkit 检测工具，它可以扫描系统的多个部分，包括文件系统、进程和内核模块，以检查是否有 Rootkit 的迹象。