possible kernel level rootkit detected from HIDS

## Describe the bug

I test the ocis wopi docker setup on my testing lab. In this testing lab is also a ossec HIDS installed. This call me a security anomaly, expect there is a possible kernel rootkit installed

## Steps to reproduce

Steps to reproduce the behavior:

1. Install debian 11.6.0 (x64)
2. Install docker 23.0.6 and docker-compose 1.29.2 (both latest)
3. Download ocis from git, edit config file and start the containers
4. install wazuh-agent 4.4.2 and check the security events

## Expected behavior

HIDS send alert about possible rootkit detected.

Anomaly detected in file '/var/lib/docker/overlay2/e282b5d445a0265472cb0015af17528f068d4121d045e27280ba3b45cdb151b9/merged/start-collabora-online.sh'.

Anomaly detected in file '/var/lib/docker/overlay2/e282b5d445a0265472cb0015af17528f068d4121d045e27280ba3b45cdb151b9/merged/start-collabora-online.sh'. Hidden from stats, but showing up on readdir. Possible kernel level rootkit.

see attached file for detailed information

## Actual behavior
System stopped and report a bug on ocis github

## Setup

https://github.com/owncloud/ocis/tree/master/deployments/examples/ocis_wopi

## Additional context

The Interface from the virtual maschine start and stop in promiscuous mode. Details see attached file

## Additional Information:

I added clamav and rkhunter to this virtual mashine to check the filesystem. Running the test one time without running ocis and onet ime with running ocis:

- clamav didn't find anything.
- rkhunter find also nothing, but im not sure if they check the folder in /var_lib/docker...