[ossec-list] Detecting new files, and running a custom shared/rootkit.txt check against them

[frankstefan]

Hi.

Scenario:

A user uploads evil.file to /home/shared/webusers/username OSSEC then
will detect a new file in /home/shared/webusers and run a custom
syscheck/rootcheck against the newly added files

Can I do this?