mx16rkhunter (Rootkit Hunter) is a free, open-source tool for Linux systems that scans for rootkits, backdoors, and possible local exploits. Updated continuously by the security community, the 2026 version adds detection for the latest kernel-level rootkits and bootkits.
Capabilities
- Rootkit detection using MD5 hash comparison
- Detection of suspicious files and hidden processes
- Hidden port scanning
- Grep-based string and regex detection
- ACL and capabilities checks
- Schedule-based scanning via cron
- Network interface monitoring
Verdict
rkhunter is an essential security tool for any Linux administrator. Combined with a traditional antivirus like ClamAV, it provides comprehensive protection against the most stealthy threats targeting Linux systems.
