Out of the box it's probably useless but if you spend some time to configure rkhunter it can be a worthwhile help in finding malware. But for anything that goes

Out of the box it's probably useless but if you spend some time to configure rkhunter it can be a worthwhile help in finding malware. But for anything that goes beyond script-kiddie attempts I'd not count on it. - It can verify hashes using the package manager. - It can report use of deleted files. After clearing the false-positives this can help to detect some malware that is only in memory and already deleted on disk - Support for unhide¹ - This should help against rootkits - but I'm not sure how reliable it is nowadays 1: http://www.unhide-forensics.info/ http://www.unhide-forensics.info/