Tools I’ve written rather than run. Each one comes with the design docs, the evidence behind the design, and an honest list of what it can’t do.
kdetect — Catching a Linux Rootkit in a Contradiction
A rootkit hides by lying to whoever asks, so asking /proc twice gets you the same lie twice. kdetect asks through channels a rootkit has to subvert separately and treats their disagreement as the finding. This is how it works, how I validated it against a real rootkit, and the false positives that nearly shipped.