I would love to see some auditing tools added. Here are some examples of things which I feel would be useful:
- Unknown SSH keys added to authorized_keys
- Unknown cronjobs added
- Unknown processes running under a user account
- New/unknown files added to user home folder (especially .local/bin)
- Scanning .bashrc, .bash_aliases, .profile, .bash_history for malware looking code (wget, base64, etc.)
- Hardened file/folder permissions
