[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[ossec-list] File anomalies

To: ossec-list@xxxxxxxxxxxxxxxx
Subject: [ossec-list] File anomalies
From: Clayton Dillard <cdillard@xxxxxxxxxxxxxxxxx>
Date: Thu, 07 Jun 2007 10:08:33 -0400
Organization: RPS Technology, LLC

Can someone provide some insight into why this alert is being fired? I get a lot of these alerts every day.

Anomaly detected in file '/usr/local/apache2/htdocs/janeway/cache/cache_94afbfb2f291e0bf253fcf222e9d238e_1af853019d87ece6588c780714841e9b'. Hidden from stats, but showing up on readdir. Possible kernel level rootkit.

What "stats" is the alert referring to?

Thanks,

--
Clayton Dillard <cdillard@xxxxxxxxxxxxxxxxx>
RPS Technology, LLC

Follow-Ups:
- [ossec-list] Re: File anomalies
  - From: Daniel Cid

Prev by Date: [ossec-list] Re: Symantec Anti-Virus log checkingq
Next by Date: [ossec-list] Re: File anomalies
Previous by thread: [ossec-list] Remote log injection paper
Next by thread: [ossec-list] Re: File anomalies
Index(es):
- Date
- Thread

OSSEC home | Main Index | Thread Index

OSSEC project: www.ossec.net.
Mailling list information: http://www.ossec.net/en/mailing_lists.html.