Tag rootkit detector