Rkhunter Setup

rkhunter-propupd.hook

# dir: /etc/pacman.d/hooks/

[Trigger]
Operation = Upgrade
Type = Package
Target = *

[Action]
Description = rkhunter --propupd
When = PostTransaction
Exec = /usr/bin/rkhunter --propupd --report-warnings-only
Depends = rkhunter

rkhunter-status.hook

# dir: /etc/pacman.d/hooks/

[Trigger]
Operation = Upgrade
Type = Package
Target = *

[Action]
Description = rkhunter.service status check
When = PreTransaction
Exec = /usr/bin/sh -c "! /usr/bin/systemctl is-failed rkhunter.service"
Depends = rkhunter
AbortOnFail = yes

rkhunter.conf.local

# Rootkit Hunter Custom Settings

## Allow some hidden directories/files
ALLOWHIDDENDIR=/etc/.git
ALLOWHIDDENFILE=/etc/.etckeeper
ALLOWHIDDENFILE=/etc/.gitignore
ALLOWHIDDENFILE=/etc/.updated
ALLOWHIDDENFILE=/usr/share/man/man5/.k5identity.5.gz
ALLOWHIDDENFILE=/usr/share/man/man5/.k5login.5.gz

## Ignore the warnings: 'The command ... has been replaced by ...'
SCRIPTWHITELIST=/usr/bin/egrep
SCRIPTWHITELIST=/usr/bin/fgrep
SCRIPTWHITELIST=/usr/bin/ldd

## False Positive: WP-CLI
RTKT_FILE_WHITELIST=/usr/bin/wp

rkhunter.service

[Unit]
Description=Rootkit Scan

[Service]
Type=oneshot
ExecStartPre=/usr/bin/rkhunter --update --report-warnings-only
ExecStart=/usr/bin/rkhunter --cronjob --report-warnings-only
ExecStartPost=/usr/bin/rkhunter --propupd --report-warnings-only

rkhunter.timer

[Unit]
Description=Daily Rootkit Scan

[Timer]
OnCalendar=05:00:00
Persistent=true

[Install]
WantedBy=timers.target

Rkhunter Custom Settings

Place rkhunter.conf.local on /etc

Scan Automatically at 5:00 AM Everyday

1. Place rkhunter.service, rkhunter.timer on /etc/systemd/system
2. Enable and start rkhunter.timer via systemctl

$ sudo systemctl enable rkhunter.timer
$ sudo systemctl start rkhunter.timer

UPDATE @ 2021-11-03: rkhunter.service

UPDATE @ 2021-11-09
Added rkhunter-propupd.hook

I made a setup script for Arch Linux that can entirely automate this rkhunter setup:
https://github.com/amekusa/arch-setup/