Greetings :-) Just got this alert, and was wondering if you could provide some specific guidance on how to investigate (step 1, 2, etc.).
New to OSSEC. OSSEC HIDS Notification. 2016 Mar 24 7:49:39 Received From: log->rootcheck Rule: 510 fired (level 7) -> "Host-based anomaly detection event (rootcheck)." Portion of the log(s): Process '13380' hidden from /proc. Possible kernel level rootkit. --END OF NOTIFICATION -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
