Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesCheck a suspected Linux server across several evidence sources: persistence mechanisms such as cron, systemd, accounts and SSH keys; loaded kernel modules and kernel messages; logs and suspicious files; and alerts or unusual behavior. These checks can reveal indicators, but a clean scan or familiar-looking system output does not prove the host is trustworthy. If you find credible signs of privileged compromise, follow your incident-response process and plan a clean rebuild or restore rather than relying on manual cleanup.
Before you investigate: protect evidence and limit risk
If the server may be part of a security incident, notify your security or incident-response team before making changes. Investigation commands and cleanup can alter timestamps, logs, or other evidence. Follow your organization’s evidence-handling procedures, and preserve relevant logs or images before changing the host when the investigation requires it.
Use trusted administrative access and compare findings with a known-good baseline if one exists. Treat the running system as a source of clues, not an unquestionable authority: a rootkit or other privileged compromise may manipulate what the host reports.
Check persistence mechanisms first
Malware that returns after reboot may be using ordinary administrative features rather than a file explicitly named “rootkit.” Look for unexpected entries and changes, and verify their owner, purpose, and history with the people responsible for the server.
#1 Best Overall
Cron jobs and systemd units or timers
- Review system-wide and user cron entries, including
/etc/crontab, cron directories, and each relevant user’s crontab. - Inspect enabled systemd services and timers for unfamiliar jobs, unusual command paths, or recent changes.
- Compare entries with a trusted configuration baseline or deployment records where available. Red Hat has reported
/etc/crontabmodification as a persistence method in its Trickbot guidance: Red Hat: Trickbot Malware.
CISA’s technical guidance includes collecting cron and systemd data when uncovering malicious activity: CISA: Technical Approaches to Uncovering Malicious Activity.
Accounts, login shells, and SSH keys
- Review local accounts, privileged group membership, and login shells for unexplained additions or changes.
- Check authorized SSH keys for relevant accounts, especially administrative and service accounts. Confirm each key with its owner rather than assuming an unfamiliar key is malicious.
- Inspect sensitive configuration for unauthorized changes and compare it with a trusted baseline when possible.
CISA specifically advises checking for additional SSH keys. Persistence may involve several mechanisms at once, so finding one suspicious entry does not establish that you have found them all.
Rank #2
Review kernel indicators without treating them as proof
Inspect loaded modules with lsmod and kernel messages with dmesg. Look for modules or loading events that are unexpected for the host’s role, kernel, and normal operating history. CISA identifies both loaded-module information and kernel messages as useful investigation artifacts in its technical approaches guide.
A recognizable module name is not enough to establish that a module is safe, and an unfamiliar one is not conclusive proof of malware. Validate findings against trusted package and configuration information, system history, and other evidence. Because a rootkit can affect what the running system reveals, do not rely on these commands alone to certify system integrity.
Recommended Free Tools
Preserve logs and examine suspicious files
Preserve and review relevant files under /var/log and journald records. Correlate authentication events, administrative actions, service changes, and other anomalies with the time a suspected change occurred. If your incident procedures require it, retain timestamps and context when collecting artifacts; avoid deleting or modifying suspicious files before the evidence-handling plan is clear.
Collect suspicious ELF executables found in writable temporary locations for analysis, including paths such as /dev/shm/tmp and /var/tmp. Their location alone does not prove maliciousness. Preserve relevant metadata and have the files analyzed using your organization’s approved process.
Correlate host findings with behavior and monitoring
Compare host artifacts with unusual logins, IDS or EDR alerts, unexpected network or service behavior, and configuration changes. A single symptom does not prove a rootkit: malware compromise can resemble other forms of attacker activity in logs and monitoring, as Red Hat’s guidance on rootkits, trojans, and malware on Red Hat Enterprise Linux explains.
Likewise, a scanner’s clean result is only one piece of evidence. Red Hat’s HiddenWasp guidance and general malware guidance support treating suspected compromise as a matter for broader analysis, not assuming a scan has established trust.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
Choose whether to continue examining, escalate, or recover
The right order depends on evidence needs and incident severity; there is no single response path for every server. Use these questions to frame the decision:
- Evidence preservation: Must logs, disk images, or other artifacts be captured before changes?
- Scope: Could related servers, accounts, credentials, or network activity also be affected?
- Trust in the host: Is privileged compromise credible enough that findings from the running installation may be unreliable?
- Recovery source: Is there a known-clean backup or trusted image, and can restored data be checked before service resumes?
- Persistence coverage: Will the response address multiple possible persistence mechanisms and include monitoring after eradication?
Escalate to your security team when indicators suggest privileged access, unexplained persistence, or a wider incident. Specialist incident-response or digital-forensics help may be appropriate when the scope is unclear or evidence must be preserved and analyzed carefully.
Recover from credible compromise with a trusted source
When compromise is credible, a clean rebuild or restore from a known-trusted backup is generally safer than assuming manual cleanup has restored confidence. Red Hat says compromised systems should usually be erased and reinstalled or restored from a trusted backup in its general malware guidance. CISA’s incident-response playbooks recommend coordinated eradication, clean reimaging, scanning for malicious code, and monitoring after eradication; they also say to rebuild hardware if rootkits are involved.
Plan recovery for more than one persistence mechanism. Restore only from a source you trust, check restored data before returning the system to service, and continue monitoring after recovery. Coordinate the sequence with the incident-response team, especially if evidence collection or other affected systems are involved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
