chkrootkit is a security utility that examines Linux systems for signs of rootkits and other potentially malicious modifications. Rootkits are tools used by attackers to conceal their presence, often by modifying system commands, hiding processes or interfering with normal operating system behaviour.
The software combines shell scripts with several small C programs to inspect system binaries, processes, directories and accounting records. It looks for known rootkit signatures and inconsistencies that may indicate a compromised machine.
chkrootkit is particularly useful as a supplementary diagnostic tool during security investigations. Its results should be interpreted carefully, as some checks can produce false positives and an absence of warnings does not establish that a system is secure.
This is free and open source software.
Key Features
- Check common system commands for modifications associated with known rootkits and trojans.
- Search for signatures of recognised rootkits, worms and malicious system modifications.
- Detect indications of hidden processes by comparing process information from different system interfaces.
- Examine processes running from memory without conventional executable files.
- Check network interfaces for unexpected promiscuous mode operation.
- Inspect login accounting records for evidence of deleted or concealed entries.
- Search for suspicious directories and files associated with known rootkit techniques.
- Includes checks for selected bootkits, backdoors and compromised system utilities.
- chkproc utility examines process information for discrepancies associated with hidden processes.
- chkdirs utility checks for directories concealed through rootkit-related techniques.
- chklastlog and chkwtmp utilities examine login accounting information for inconsistencies.
- Expert mode displays suspicious strings from system commands for closer investigation.
- Support for using trusted alternative system binaries when examining a potentially compromised installation.
- Ability to examine an alternative root filesystem, including one mounted for offline investigation.
- Can be incorporated into scheduled administrative checks and security auditing procedures.
Website: www.chkrootkit.org
Support:
Developer: Nelson Murilo, Klaus Steding-Jessen
License: BSD 2-Clause ‘Simplified’ License
Related Software
| Anti-Malware Tools | |
|---|---|
| ClamAV | Antivirus engine for detecting trojans, viruses, malware and other threats |
| YARA-X | Re-incarnation of YARA |
| YARA | Pattern matching swiss knife for malware researchers |
| Maltrail | Malicious traffic detection system |
| ClamTk | Graphical frontend for ClamAV |
| LMD | Malware scanner focusing on threats faced in shared hosted environments |
| phpMussel | PHP-based anti-virus anti-trojan anti-malware solution |
| Raspirus | Lightweight signature-based malware scanner |
| FastFinder | Fast suspicious file finder |
| chkrootkit | Locally checks for signs of a rootkit |
| Unhide | Forensic tool to find hidden processes and TCP/UDP ports |
| Atomdrift Scan | Malware and supply chain scanner for software security |
| paranoya | Malware scanner using indicators of compromise and YARA rules |
| decloaker | Security tool for revealing objects concealed by malware |
| Lenspect | Lightweight security threat scanner |
Read our verdict in the software roundup.
| Host-Based Intrusion Detection Systems | |
|---|---|
| Wazuh | Platform used for threat prevention, detection, and response |
| OSSEC | Full platform to monitor and control your systems. |
| Falco | Cloud native runtime security tool |
| Tracee | Runtime security and observability tool |
| AIDE | Advanced Intrusion Detection Environment |
| Logwatch | Powerful and versatile log parser and analyzer |
| Samhain | File integrity checking and log file monitoring/analysis and more |
| Sagan | Multi-threads, high performance log analysis engine |
| Hades | Uses eBPF and the netlink process connector to monitor activity |
| rkhunter | Scans for rootkits, backdoors and possible local exploits |
| Tripwire | Security and data integrity tool |
| chkrootkit | Locally checks for signs of a rootkit |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.