New IOC tool has eliminated a lot of the false positives from what I can see.

Same here

Yep, agreed.

yep. they probably eliminated noise from post upgrade spraying attempts

jep..hurray

I've been running the IoC scan periodically and just saw this Status. I ran the scan again immediately and it went away. Has anyone seen this and/or think it's concerning? Result: [ { "ioc_name": "Suspicious php files", "status": "ok" }, { "ioc_name": "Potentially suspicious files", "status": "ok" }, { "ioc_name": "setuid files", "status": "ok" }, { "ioc_name": "Suspicious nobody processes", "status": "matched", "message": "Suspicious processes found.", "path": "[-] nobody 86862 0.0 0.0 0 0 - Z 20:23 0:00.04 <defunct>\n", "reference": "" }, { "ioc_name": "Suspicious config file alterations", "status": "ok" }, { "ioc_name": "Artifact removal indicators", "status": "ok" }, { "ioc_name": "Suspicious memory overread", "status": "ok" }, { "ioc_name": "IP addresses associated with likely C2", "status": "ok" }, { "ioc_name": "Known malicious file hashes", "status": "ok" } ]

It looks like a false positive, no clear name for the process, etc. I wouldn't over worry.