anchor.diff:  pgrep -x "crond" | xargs -I '{}' ls -la "/proc/{}/exe"
   ----
   
  -Anything looking like `/tmp/ ` (with a space) in the output is very
  +Anything looking like +"/tmp/&nbsp;"+ (with a space) in the output is very
   suspicious.
   
  -`pgrep` requires the `procps` package. Replace `pgrep -x crond` with `ps -ef |
  -grep crond | grep -v grep | awk '{print $2}'` if you can't install `pgrep`.
  -
  +`pgrep` requires the `procps` package. If you can't install the package,
  +replace:
  +
  +----
  +pgrep -x crond
  +----
  +
  +with
  +
  +----
  +ps -ef | grep crond | grep -v grep | awk '{print $2}'
  +----
   
   == Network-based Indicators
   
  
positive.code: 
  NOTE: This technique is ineffective if your distribution applied the patches
        for http://roumenpetrov.info/openssh/[X.509 certificate support] in
        OpenSSH. Gentoo with the X509 USE flag is one such distribution. Use
        the shared memory inspection technique in that case.
  
  The command `ssh -G` has a different behavior on a system with
  
negative.code: ==== Shared Memory Inspection
  
  Linux/Ebury relies on POSIX shared memory segments (SHMs) for interprocess
  communications. Currently, it uses large segments of over 3 megabytes of
  memory.
  
  CAUTION: Other processes could legitimately create shared memory segments.
           Make sure to validate that `sshd` is the process that created the
           segment like we show below.
  
  Identify large shared memory segments by running the following as root:
  
  [listing]
  ....
  