You can run an automated rootkit detector, but I doubt anyone able to get that far will be caught that easily. Your best bet is using application specific monit

You can run an automated rootkit detector, but I doubt anyone able to get that far will be caught that easily. Your best bet is using application specific monitoring, eg for WordPress there are excellent tools like Wordfence that monitor login attempts, file changes and block common attacks. For my custom apps I will be alerted on brute force attempts, weird queries (sql injection attempts) and pretty much any anomaly is logged and will stand out. Another big one is monitoring for weird resource usage, I use Netdata for this. But doing some upfront hardening is the most effective way. I have yet to be hacked (as far as I can tell) operating multiple VPS servers in 10 year+ timespan. But have worked with companies that frequently had their servers compromised due to poor security practices.