Don’t use it myself, but heard good things about Sandfly Security. Doesn’t use signatures but rather looks for odd things and detects HiddenWasp due to simple things like processes running from /tmp and users with uid 0