A lot of Linux incident response starts with a login question, not a malware sample.
Someone sees a spike of failed SSH attempts. A root login appears in the wrong time window. A service account logs in from an address nobody recognizes. A helpdesk ticket says "the server looks weird" and the only concrete clue is a username or IP address.
At that point, the useful question is not "is this host compromised?" It is more boring and more important:
Did anyone actually authenticate?
Which account was involved?
