The Linux second extended file system (chattr, and
lsattr for more information) allows the user to set
more file attributes.
Most of the Linux hack kits use these attributes to
attempt to lock their hacks in whereas most
distrubutions don't use these attributes.
Saving/Checking these attributes would aid greatly in
detection of the crack kits that use this techniques.