AIDE is a tool for monitoring file system changes. It can be used to detect unauthorized monitored files and directories. AIDE was written to be a simple and free alternative to Tripwire.
Much more lightweight than the more commonly used solutions for this problem these days.
Packaged by just about every distro these days.