Break-in
Host has been compromised.
- Deleted or modified log files
- Installation of a rootkit
- Programs behave in a strange way
- Unexpected logins to privileged users
- New services running
- Changed login prompt
- New programs running
- Unaxpected changes in disk space usage
- Probes from inside the network