How to Scan for Rootkits with rkhunter

rkhunter scans your system for rootkits, backdoors, and other malware.

Install

apt install rkhunter -y

Update and Scan

rkhunter --update
rkhunter --check

Automated Scans

Run weekly via cron:

crontab -e
# Add:
0 3 * * 0 /usr/bin/rkhunter --check --cronjob --report-warnings-only | mail -s "rkhunter report" admin@example.com

Handle False Positives

After reviewing warnings, update the baseline:

rkhunter --propupd