Datadog Interview Question

-How would you detect a rootkit -How would you design a security rule