Compares /proc entries with the output of ps to find processes a rootkit or kernel module is hiding. Hidden processes often mean the box is compromised. Other tests include unhide sys, which checks against system calls. Run it alongside rkhunter --check for a deeper sweep.
Looking for more? Search all 7,657 commands — works offline, in English or Spanish, and fixes typos.