A successful shell attack was detected.
A 'passwd' command occurred in a TCP session normally used for a standard service. This indicate that successful compromise of this service has occurred.
The command activity observed is indicative of a possible compromise. Consider performing a full audit of the system to investigate further.