sudo mkdir /mnt/sys
sudo mount -o ro /dev/sdXN /mnt/sys   # find the right partition with lsblk first
sudo smartctl -a /dev/sdX             # look for reallocated sectors, pending sectors, offline uncorrectable
sudo fsck -n /dev/sdXN                # dry-run check, don't fix yet

chroot /mnt/sys /bin/bash             # after binding /dev /proc /sys in
cat /etc/passwd                       # any new/unexpected user accounts?
cat /etc/shadow                       # password hash changed on admin account?
last -f /var/log/wtmp                 # login history, any logins melo doesn't recognize?
systemctl list-units --state=enabled | less   # anything unfamiliar enabled?
crontab -l -u root                    # rogue cron jobs?
ls -la /etc/systemd/system/           # anything dropped in that shouldn't be there?