After reading what Metasploit is able to do my grey hairs got even more.
From my understanding current attack methods are being done without tampering with any file in a filesystem - thus rendering file based HIDS useless.
So my idea was: What about the blacklist-approach? Is there an (OpenSource) IDS tool out there that just monitors what is going on in the system (e.g. looks at
ps output) and sounds an alarm if something strange is going on there (e.g. a httpd child forking a shell)?