Other directories used to hide intruders' files

• /usr/man/tmp
• directories under /var/spool/lp

File names used for intruders' software and configs

• /dev/ptyp, /dev/ptyq, and /dev/ptyr
• /dev/ttyp
• /usr/bin/dpipe
• /usr/bin/neterm
• /usr/bin/ns
• /usr/bin/procs
• /usr/bin/xcat
• /usr/sbin/login