On Nov 19, 5:07 pm, x509v3 <[email protected]> wrote: <snip> > Rule: 510 fired (level 7) -> "Host-based anomaly detection event > (rootcheck)." > Portion of the log(s): > > Port '60256'(tcp) hidden. Kernel-level rootkit or trojaned version of > netstat.
I received a similar alert earlier today, albeit mine was for port 631 that is normally used by cupsd, although cupsd is not actually running on the specific system that had the alert. I found this thread http://www.mail-archive.com/[email protected]/msg02073.html and used the techniques outlined by Dave Lowe to provide a level of comfort that the netstat binary was using an inode that appeared to be the original. Albeit I am not sure how well that will translate to your AIX system although I understand AIX Unix also uses inodes. Second thing I found was this link http://www.ossec.net/dcid/?p=87 that talked about similar types of false positives. And finally, I used a Linux utility called unhide-tcp that showed the actual hidden port, and then ran nmap against the port that confirmed it was closed. Bottom line .... I have a high certainty that it was a false positive, and given you have received the same message, suspect it relates to a specific overzealous rule because all the subsequent checks show no signs of a problem. cheers ... david
