Compromised Web Server

The SOC flagged repeated outbound connections from a production web server to an unknown external address on port 4444. You have a shell on the host. Investigate, identify the threat, and contain it without taking the server offline.

Environment

Host: web-01
Internal IP: 10.0.4.21
OS: Ubuntu 22.04 LTS
Alert: Outbound → 185.220.101.47:4444

Objectives

1Identify the process making the suspicious connection.
2Find how the malware survives a reboot.
3Block the malicious egress traffic at the host firewall.

Allowed tools

netstat -tulpn
ps aux
crontab -l
cat /var/log/auth.log
iptables
kill

analyst@web-01: ~ — bash — 120×32

Free scenario · unlimited

Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-91-generic x86_64)

Last login: Mon Nov 10 02:11:37 2026 from 10.0.4.5
# Type help to list tools. Run as many commands as you like, then type submit to grade.