First of all, only one alert will be sent with the information on the potential backdoor. We will take advantage of this stage to adapt
the filters if necessary.
Then, the alerts will be recurrent, till a possible reboot of the server in rescue mode in order to drive the administrator of the server to react.
If a backdoor is launched on the server, this means that it is in danger. Generally, backdoors are used to launch distant attacks, however, sometimes, this fault may lead to a data loss. It is important that the administrator reacts as soon as possible in order to remove the backdoor and make up the fault.