You can configure WHM to kill any of the following processes and send you an email when it finds one of them. Malicious users may run an IRC bouncer on their shell accounts even though this may be against your policy. WHM detects these processes correctly even if the bouncer is renamed (e.g. to something that appears non-malicious like “pine”, to give the impression that the user is just reading email).

Please check the names of any programs you do not want running on your server; we recommend that you check them all since letting users run IRC bots and servers usually leads to denial-of-service attacks.