Alternatives to chkrootkit
A command-line tool that checks Unix-like systems locally for signs of a rootkit. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
chkrootkit
A command-line tool that checks Unix-like systems locally for signs of a rootkit.
Replacements
Listings that take over the same core job as chkrootkit.
OSSEC
An open-source host-based intrusion detection system with log analysis, file integrity monitoring and active response.
OSSEC is a self-hosted host intrusion detection system combining log analysis, file integrity monitoring and rootkit detection with active response, beyond chkrootkit's local checks.
Wazuh Agent
Endpoint agent that feeds a Wazuh server with security and compliance data.
Wazuh Agent adds rootkit detection alongside file integrity monitoring and log collection on Windows and Linux, but requires a Wazuh manager and indexer.
THOR Lite
A free multi-platform IOC and YARA scanner for checking systems for signs of compromise.
THOR Lite scans files, processes and autoruns with YARA and IOC signatures on Windows, Linux and macOS, though it is not open source.
Lynis
Audit Unix-like systems for hardening opportunities.
Lynis audits Unix-like systems for hardening opportunities and reports suggestions rather than focusing on known rootkit signatures like chkrootkit.
AIDE
A file and directory integrity checker that records file attributes and hashes, then reports changes.
AIDE detects unexpected file changes by comparing against a trusted baseline of hashes and attributes instead of checking for known rootkits.
Similar software
Related functionality, not a direct replacement.
Chainsaw
Search Windows forensic records for suspicious activity.
