Summary: "Keep It Clean!" by Markus Stubbig

Here's the gist of a good article (from Admin magazine issue 89) about Linux antivirus, antimalware and anticrapware in general. He does mention that there are paid products out there, such as Trend Micro's ServerProtect, but the emphasis is on familiar open source animals.

CLAMAV
This is an antivirus scanner for which life began for Linux in 2001 and began for Windows in 2013. Now a Cisco product but not substantially different from before, it's available in practically all repositories. Updating is done with the command 'freshclam' and you get the party started with "clamscan /home" or such. ClamTk and ClamWin are the GUIs available. Stubbig notes that SecuriteInfo sells unofficial signatures, with a free plan if you can stand a delay in availability. Real-time scanning is possible after certain configuration procedures.

LMD
Linux Malware Detect is similar to the above in that it's a virus scanner, but it also looks for other kinds of baddies like rootkits. It can be configured to work along with clamav by sharing signatures and in other ways. It has an auto-quarantine function that's possible. Installation is from the GitHub tarball.

RKHUNTER
This one's in the repositories. It creates a report, having searched for 80 or so rootkits and other questionable things. There's no realtime setting but it works with cron, runs non-interactively and produces the usual summary at the end, sent to a log file. The noted item to watch for is "Possible Rootkits".

WAZUH
This is a SIEM that's open source, and includes more than monitoring. It's a system rather than a single install, using a server and agents on all devices to watch. It's also not useful immediately since it checks things periodically, and in order to see patterns you have to run it awhile so you have a depth of many scans to allow for comparison. It does file integrity monitoring, intrusion detection, vulnerability detection, log analysis, config monitoring, mapping according to MITRE ATTACK fw and can do some automated responses. There are agents for Linux and Windows, and info is at wazuh.com and there's a good tutorial at tech-insider.org titled "wazuh-siem-tutorial-2026".

He does not go into other similar programs but does mention auditors like OpenVAS, Lynis and Trivy. Then there's file integrity checkers like Tripwire and Integrit. Enjoy.