This script, run on a regular (daily) basis, keeps tabs on root accounts and set[ug]id root files.
You can download it from the following link: https://packetstormsecurity.com/files/download/12850/sysmon.tar
Source: https://packetstormsecurity.com/files/12850/sysmon.tar.html