%%OSSEC_HOME%%/etc/shared/rootkit_files.txt
%%OSSEC_HOME%%/etc/shared/rootkit_trojans.txt
%%OSSEC_HOME%%/etc/shared/system_audit_rcl.txt
%%OSSEC_HOME%%/etc/shared/system_audit_ssh.txt
/var/ossec/etc/shared/rootkit_files.txt
/var/ossec/etc/shared/rootkit_trojans.txt
/var/ossec/etc/shared/system_audit_pw.txt
/var/ossec/etc/shared/system_audit_rcl.txt
/var/ossec/etc/shared/system_audit_ssh.txt