I have used chkrootkit and rkhunter in the past. Will copy them to my overlay (https://github.com/petteyg/gentoo-overlay) if they don't get a maintainer.

On Fri, Aug 11, 2017 at 12:49 PM, RB <aoz.syn@gmail.com> wrote:
On Fri, Aug 11, 2017 at 11:40 AM, Michał Górny <mgorny@gentoo.org> wrote:
> app-admin/integrit
> app-forensics/afflib [o]
> app-forensics/air
> app-forensics/autopsy
> app-forensics/chkrootkit [o]
> app-forensics/cmospwd
> app-forensics/examiner
> app-forensics/galleta
> app-forensics/libewf [o]
> app-forensics/lynis
> app-forensics/mac-robber
> app-forensics/magicrescue
> app-forensics/memdump
> app-forensics/pasco
> app-forensics/rifiuti [o]
> app-forensics/rkhunter
> app-forensics/scalpel [o]
> app-forensics/sleuthkit [o]
> net-mail/libpst [o]
> sys-apps/dcfldd
> sys-block/disktype

The pentoo.ch overlay has superseded and expanded on a lot of these. I
gave up on trying to provide patches and updates for this category
long ago, but they have picked up the flag and are doing a good job.