Introduction to Rkhunter
\n
Rkhunter (Rootkit Hunter) is an open-source command-line utility whose main goal is to detect the presence of rootkits, backdoors, and other unauthorized modifications on a Linux system. Unlike traditional antivirus, which search for malicious code patterns in files, Rkhunter focuses on comparing system attributes (such as binary hashes, permissions, and versions) with known signature databases and running heuristic tests that reveal suspicious behavior. Its use is especially valuable on production servers where environment integrity is critical.
\n
What is a rootkit and why is it dangerous?
\n
A rootkit is a set of tools designed to hide its activity and that of other malicious processes within the operating system. By gaining root privileges, the attacker can modify kernels, replace system binaries, and create backdoors that remain invisible to conventional monitoring tools. This allows maintaining persistent access, exfiltrating data, launching additional attacks, or turning the machine into part of a botnet without the administrator noticing.
\n
How Rkhunter Works
\n
Rkhunter operates in several phases. First, it updates its signature database using the command rkhunter --update, downloading the latest definitions of known rootkits and vulnerabilities.
This post is also available in ESPAÑOL.