It would be nice if rkhunter could scan for nasty jobs in /etc/cron.* and /var/spool/cron/*
We've found nasty stuff in user cronjobs on several occasions. Maybe check for jobs that try to access files like /etc/passwd or jobs that try to run something in /tmp.
Log in to post a comment.