PRACTICE
PBQS

Performance Based Question 11

Scenario: You are a Junior Incident Response professional investigating an incident. You believe a Linux workstation is infected with a malicious script. Select the appropriate Linux commands below to investigate and resolve the incident.

Question 1 of 4

Select a command to display active network connections on this system:

Question 2 of 4

The network information data shows a connection as follows: TCP 192.168.1.5:5000 216.10.22.51:4444 ESTABLISHED 1069. You believe there is a malicious process with ID 1069 communicating with external IP address 216.10.22.51. You query your threat intelligence feed. The IP address 216.10.22.51 is known to be associated with malicious threat actors. What command can help you discover which files are running under process 1069?

Question 3 of 4

Before taking action, you decide to kill the process 1069 to prevent further damage and contain the incident. What command would you use?

Question 4 of 4

Your earlier investigation shows that process PID 1069 is associated with a file at /var/www/revshell.sh. Now that the process has been stopped, how would you clean up this script and remove it?