Hi Arcady,

On Wed, 26 Nov 2025 09:57:28 +1200 (PETT)
Arcady Ivanov <it.chief@???> wrote:

> I have Wazuh in my network. Wazuh informs that on each of this
> computers
>
> I have:
>
> Trojaned version of file '/usr/bin/chsh' detected. Signature used:
> 'bash|file\.h|proc\.h|/dev/ttyo|/dev/[A-Z]|/dev/[a-s,uvxz]' (Generic).
>
> Trojaned version of file '/bin/passwd' detected. Signature used:
> 'bash|file\.h|proc\.h|/dev/ttyo|/dev/[A-Z]|/dev/[b-s,uvxz]' (Generic).
>

likely a false positive

see https://github.com/wazuh/wazuh/issues/20363#issuecomment-3450739212

and

https://github.com/wazuh/wazuh/issues/32142

In any case is not Devuan specific, it affects Debian and other
derivatives (Ubuntu) as well.

Best,
Lorenzo

>
>
>
> IKIR IT Chief. Arcady Ivanov.
>
> phone: +7(914)024-4191
>
> mailto: arc@???
>