When you log into a Linux system, make it a habit to look at the processes with this command:

ps -auxwf

This will list out all processes in tree format. It makes it easy to spot unusual activity.

For instance, this is what a PHP reverse bindshell backdoor will look like.