anchor.diff:  
   NOTE: This technique is ineffective if your distribution applied the patches
         for http://roumenpetrov.info/openssh/[X.509 certificate support] in
  -      OpenSSH. Gentoo with the X509 USE flag is one such distribution. Use
  +      OpenSSH. Gentoo with the `X509` USE flag is one such distribution. Use
         the shared memory inspection technique in that case.
   
   The command `ssh -G` has a different behavior on a system with
  
positive.code: pgrep -x "crond" | xargs -I '{}' ls -la "/proc/{}/exe"
  ----
  
  Anything looking like `/tmp/ ` (with a space) in the output is very
  suspicious.
  
  `pgrep` requires the `procps` package. Replace `pgrep -x crond` with `ps -ef |
  grep crond | grep -v grep | awk '{print $2}'` if you can't install `pgrep`.
  
  
  == Network-based Indicators
  
  
negative.code: ==== Shared Memory Inspection
  
  Linux/Ebury relies on POSIX shared memory segments (SHMs) for interprocess
  communications. Currently, it uses large segments of over 3 megabytes of
  memory.
  
  CAUTION: Other processes could legitimately create shared memory segments.
           Make sure to validate that `sshd` is the process that created the
           segment like we show below.
  
  Identify large shared memory segments by running the following as root:
  
  [listing]
  ....
  