[ossec-list] Maybe a false positive with rule 510

carlopmart Thu, 03 Mar 2011 09:43:23 -0800

Hi all,

 Recentlly my OSSEC server fired some strange alarms like this:


** Alert 1299172717.237104: mail  - ossec,rootcheck,
2011 Mar 03 18:18:37 (rhelclunode02) 172.25.50.15->rootcheck
Rule: 510 (level 7) -> 'Host-based anomaly detection event (rootcheck).'
Src IP: (none)
User: (none)

Anomaly detected in file '/dev/shm/request_buffer-dAihk0'. Hidden fromstats, but showing up on readdir. Possible kernel level rootkit.


** Alert 1299172717.237456: mail  - ossec,rootcheck,
2011 Mar 03 18:18:37 (rhelclunode02) 172.25.50.15->rootcheck
Rule: 510 (level 7) -> 'Host-based anomaly detection event (rootcheck).'
Src IP: (none)
User: (none)

Anomaly detected in file '/dev/shm/control_buffer-ru8tPJ'. Hidden fromstats, but showing up on readdir. Possible kernel level rootkit.

rhelclunode02 is a RHEL6 host with corosync, cman, gfs2-tools andrgmanager utils (RedHat Cluster suite).


 using lsof output is:

[root@rhelclunode02 shm]# lsof |grep control_buffer

corosync 1138 root DEL REG 0,1510428 /dev/shm/control_buffer-9fxbY1corosync 1138 root DEL REG 0,159218 /dev/shm/control_buffer-1mXd0Rcorosync 1138 root DEL REG 0,159113 /dev/shm/control_buffer-mTF2Cecorosync 1138 root DEL REG 0,159001 /dev/shm/control_buffer-OVi71xcorosync 1138 root DEL REG 0,158809 /dev/shm/control_buffer-o1dQ5Ocorosync 1138 root DEL REG 0,158735 /dev/shm/control_buffer-vBpxIncorosync 1138 root DEL REG 0,158741 /dev/shm/control_buffer-W1rVPzfenced 1199 root DEL REG 0,159113 /dev/shm/control_buffer-mTF2Cefenced 1199 root DEL REG 0,158809 /dev/shm/control_buffer-o1dQ5Odlm_contr 1216 root DEL REG 0,1510428 /dev/shm/control_buffer-9fxbY1dlm_contr 1216 root DEL REG 0,159218 /dev/shm/control_buffer-1mXd0Rdlm_contr 1216 root DEL REG 0,158741 /dev/shm/control_buffer-W1rVPzdlm_contr 1216 root DEL REG 0,158735 /dev/shm/control_buffer-vBpxIngfs_contr 1270 root DEL REG 0,159001 /dev/shm/control_buffer-OVi71x

[root@rhelclunode02 shm]# lsof |grep control_buffer-ru8tPJ
[root@rhelclunode02 shm]# lsof |grep request_buffer-

corosync 1138 root DEL REG 0,1510429 /dev/shm/request_buffer-zSLv1Ecorosync 1138 root DEL REG 0,159219 /dev/shm/request_buffer-k633xgcorosync 1138 root DEL REG 0,159114 /dev/shm/request_buffer-KjbfSxcorosync 1138 root DEL REG 0,159002 /dev/shm/request_buffer-Gmeo3Qcorosync 1138 root DEL REG 0,158810 /dev/shm/request_buffer-AieBL7corosync 1138 root DEL REG 0,158736 /dev/shm/request_buffer-JI55eGcorosync 1138 root DEL REG 0,158742 /dev/shm/request_buffer-DjNinSfenced 1199 root DEL REG 0,159114 /dev/shm/request_buffer-KjbfSxfenced 1199 root DEL REG 0,158810 /dev/shm/request_buffer-AieBL7dlm_contr 1216 root DEL REG 0,1510429 /dev/shm/request_buffer-zSLv1Edlm_contr 1216 root DEL REG 0,159219 /dev/shm/request_buffer-k633xgdlm_contr 1216 root DEL REG 0,158742 /dev/shm/request_buffer-DjNinSdlm_contr 1216 root DEL REG 0,158736 /dev/shm/request_buffer-JI55eGgfs_contr 1270 root DEL REG 0,159002 /dev/shm/request_buffer-Gmeo3Q

Maybe is it a false positive?? can I configure more verbose optionsfor this alarm??


Thanks.
--
CL Martinez
carlopmart {at} gmail {d0t} com

[ossec-list] Maybe a false positive with rule 510

Reply via email to