AIDE is a tool for monitoring file system changes. It can be used to detect unauthorized monitored files and directories. AIDE was written to be a simple and free alternative to Tripwire.
Much more lightweight than the more commonly used solutions for this problem these days.
Packaged by just about every distro these days.
How to configure AIDE so it works when somebody turned SElinux off on the machine and you can't turn it back on.