Description
Basic rootkit indicators can be checked as part of a larger host-auditing workflow. This is useful for administrators who use rkhunter or similar tools and want another small detector in the scan chain.
It is a security auditing helper, not proof that a system is clean. Findings need investigation, and compromised systems should be handled with a broader incident-response process.