Intrusion detection is the art of knowing when a bad guy is standing in the room with you, holding a loaded gun to your head. Believe me, this can be harder than it sounds when the room is a network and its operating systems. In this chapter, we teach you how to detect the subtle and insidious acts of the typical script kiddie once he gains access to an account on your computer. In the next chapter, we will present a tool that can help you stop the barbarian at the gate so that you don't have to corner him and explain what indoor plumbing is for.