Rootstealer is a program to detect when a linux user opens a terminal with root and it injects intrusive commands in the terminal with X11.
You can download it from the following link: https://packetstormsecurity.com/files/download/146724/rootstealer-master.zip
Source: https://packetstormsecurity.com/files/146724/Rootstealer-X11-Code-Executor.html