Filesystem Activity Following a SSH Compromise: An Empirical Study of File Sequences. - Jesus Molina; Xavier Chorin; Michel Cukier (ICISC, 2007)