Greetings: I ran ossec-rootcheck manually on a server, and it found the following:
[FAILED]: Port '32836'(tcp) hidden. Kernel-level rootkit or trojaned version of netstat. [FAILED]: Port '32887'(tcp) hidden. Kernel-level rootkit or trojaned version of netstat. [FAILED]: Port '32888'(tcp) hidden. Kernel-level rootkit or trojaned version of netstat. [FAILED]: Port '32889'(tcp) hidden. Kernel-level rootkit or trojaned version of netstat. [FAILED]: Port '33430'(tcp) hidden. Kernel-level rootkit or trojaned version of netstat. How can I verify if this is a false positive or not? Thank you.
