????????????????????????????

??????????????/?????????????????

............/...............

.........................../...

?????????????????????????????

>>>>>>>>>>>>>/>>>>>>>>>>>>>>>>>



ÿØÿà JFIF 

  
 
  ÿÛ „ 	 ( %!1!%)+//.383,7(-.+


                                                                                                   

-%%-////---/-.+/--+------/------/--0+--/-/-----.-----ÿÀ  ¥
2
" 

ÿÄ  
 

            
ÿÄ J 
 	    
 ! 1AQ"aq2‘#BR‚¡ÁÑ3br’¢±Âð$CSƒ²á4c“%DsÓñÿÄ 

 

            
ÿÄ *
 
       
!1AQa‘"2q3±ð#b¡ÿÚ 
  ? ¼Q





xJQaÍuò¸Zö Úü8,Ð







Úú
"SSn<rçù–´
âE—^ªBÖ9À\†¸ÔÁT­ÃÛ5
ëd´³Í#Ý;Þ38œî ¶H£M:wÎ3…³…âpÔF&‚FK¸9„â4àGEõªfÿ ‘ñ(ßw­pŽF|È¥ù®häðÍѶ¹‘[ÒinÙW¶ùñY˜Q{›K"išÒ[Ú8žë\F¹@-?v"ÔU”,ìöžkÿ {I‡£šÍ?e
ríV
?>
.........................................
.............................................................................                                                  





<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

>>>>>>>>>>>>>/>>>>>>>>>>>>>>>>>>

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>


















????????????????????????????

??????????????/?????????????????

............/...............

.........................../...

?????????????????????????????

>>>>>>>>>>>>>/>>>>>>>>>>>>>>>>>



ÿØÿà JFIF 

  
 
  ÿÛ „ 	 ( %!1!%)+//.383,7(-.+


                                                                                                   

-%%-////---/-.+/--+------/------/--0+--/-/-----.-----ÿÀ  ¥
2
" 

ÿÄ  
 

            
ÿÄ J 
 	    
 ! 1AQ"aq2‘#BR‚¡ÁÑ3br’¢±Âð$CSƒ²á4c“%DsÓñÿÄ 

 

            
ÿÄ *
 
       
!1AQa‘"2q3±ð#b¡ÿÚ 
  ? ¼Q





xJQaÍuò¸Zö Úü8,Ð







Úú
"SSn<rçù–´
âE—^ªBÖ9À\†¸ÔÁT­ÃÛ5
ëd´³Í#Ý;Þ38œî ¶H£M:wÎ3…³…âpÔF&‚FK¸9„â4àGEõªfÿ ‘ñ(ßw­pŽF|È¥ù®häðÍѶ¹‘[ÒinÙW¶ùñY˜Q{›K"išÒ[Ú8žë\F¹@-?v"ÔU”,ìöžkÿ {I‡£šÍ?e
ríV
?>
.........................................
.............................................................................                                                  





<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

>>>>>>>>>>>>>/>>>>>>>>>>>>>>>>>>

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>


















## These rules watch for code injection by the ptrace facility.
## This could indicate someone trying to do something bad or
## just debugging

#-a always,exit -F arch=b32 -S ptrace -F key=tracing
-a always,exit -F arch=b64 -S ptrace -F key=tracing
-a always,exit -F arch=b32 -S ptrace -F a0=0x4 -F key=code-injection
-a always,exit -F arch=b64 -S ptrace -F a0=0x4 -F key=code-injection
-a always,exit -F arch=b32 -S ptrace -F a0=0x5 -F key=data-injection
-a always,exit -F arch=b64 -S ptrace -F a0=0x5 -F key=data-injection
-a always,exit -F arch=b32 -S ptrace -F a0=0x6 -F key=register-injection
-a always,exit -F arch=b64 -S ptrace -F a0=0x6 -F key=register-injection