Even if you paid for access to a list of known-good binaries you would still need to have your own local list. e.g. Malicious exploit drops in /etc/cron.d/botn

Even if you paid for access to a list of known-good binaries you would still need to have your own local list. e.g. Malicious exploit drops in /etc/cron.d/botnet. You might also feel safe if you have "good" copy of bash, but your version matched a checksum from pre-shellshock. Really making the list is easy, you could do it yourself, or you could pay somebody to give you one, but it doesn't solve the problem because you'll still have local changes you need to flag/whitelist/update.