yara VS linux-malware-detect

Linux has (free) tools to improve security and detect/remove malware: Lynis,Chkrootkit,Rkhunter,ClamAV,Vuls,LMD,radare2,Yara,ntopng,maltrail,Snort,Suricata...

Shameless plug: I wrote a small poc module to use hashlookup's bloom filter in yara (https://github.com/VirusTotal/yara). The idea is to easily discard files that are known to be safe and so to avoid launching thousands of yara rules on a file for nothing. One can also use it to keep track of some files that meet certain conditions for instance. The module can store any string in these filters so I see a lot of useful use-cases for this little thingy :)

YARA - https://virustotal.github.io/yara/

Linux has (free) tools to improve security and detect/remove malware: Lynis,Chkrootkit,Rkhunter,ClamAV,Vuls,LMD,radare2,Yara,ntopng,maltrail,Snort,Suricata...

Unfortunately yes. On the plus side, this will help ensure they can't get in again. One more thing to add that list... You can use maldet to check for malware/compromised files. It's not the best malware scanner, but it's free and can help find malware in other hidden folders/files: https://www.rfxn.com/projects/linux-malware-detect/

there is also linux-malware-detect - maldet -- https://www.rfxn.com/projects/linux-malware-detect/ [github repo] -- which can work in tangent with what you mentioned, ClamAV, but is not a requirement for operation..

when the package being installed is intended to be ran as a systemd service, the PKGBUILD file, which we'll reference maldet's as an example, contains a line with a command, see line 107, that places the service file, in our case this file into the location specified, /usr/lib/systemd/system/maldet.service.