auditd
auditd copied to clipboard
add systemd-detect-virt to suspicious activity
trafficstars