Break-in
Host has been compromised.
-  Deleted or modified log files
 -  Installation of a rootkit
 -  Programs behave in a strange way
 -  Unexpected logins to privileged users
 -  New services running
 -  Changed login prompt
 -  New programs running
 -  Unaxpected changes in disk space usage
 -  Probes from inside the network