chkrootkit
A command-line tool that checks Unix-like systems locally for signs of a rootkit.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get chkrootkit
Package managers
- Homebrew
brew install chkrootkit
About chkrootkit
chkrootkit is a shell script plus a set of small C programs that check a system for signs of compromise. It looks for modified system binaries, interfaces in promiscuous mode, deleted lastlog, wtmp and utmp entries, and signs of loadable kernel module trojans, and it tests for a long list of known rootkits.
The project has been maintained for over 25 years. Version 0.59, released on 1 January 2026, added checks for processes run from memory, the XZ backdoor and the Bootkitty UEFI bootkit.
Strengths
- Checks for many known rootkits and trojaned binaries
- Detects deleted login records and promiscuous interfaces
- Recent release adds XZ backdoor and UEFI bootkit checks
Limitations
- Command-line only
- Runs on the system it checks, so a thorough rootkit could hide from it
Details
- Pricing
- FreeFree to download and use.
- License
- Open source, license not stated
- Platforms
- Linux, Command line
- How it runs
- Downloadable app
- Account
- Not required
- Works offline
- Yes
- Best suited for
- Administrators checking Linux and Unix servers for signs of compromise
- Categories
- Security tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to chkrootkit
Compare allSoftware that can replace chkrootkit for an important use case, and what changes if you switch.
OSSEC
An open-source host-based intrusion detection system with log analysis, file integrity monitoring and active response.
OSSEC is a self-hosted host intrusion detection system combining log analysis, file integrity monitoring and rootkit detection with active response, beyond chkrootkit's local checks.
Wazuh Agent
Endpoint agent that feeds a Wazuh server with security and compliance data.
Wazuh Agent adds rootkit detection alongside file integrity monitoring and log collection on Windows and Linux, but requires a Wazuh manager and indexer.
THOR Lite
A free multi-platform IOC and YARA scanner for checking systems for signs of compromise.
THOR Lite scans files, processes and autoruns with YARA and IOC signatures on Windows, Linux and macOS, though it is not open source.
Lynis
Audit Unix-like systems for hardening opportunities.
Lynis audits Unix-like systems for hardening opportunities and reports suggestions rather than focusing on known rootkit signatures like chkrootkit.
AIDE
A file and directory integrity checker that records file attributes and hashes, then reports changes.
AIDE detects unexpected file changes by comparing against a trusted baseline of hashes and attributes instead of checking for known rootkits.
Similar software
Related functionality, not necessarily a direct replacement.
Chainsaw
Search Windows forensic records for suspicious activity.
