Question

While investigating a compromised Ubuntu web server, an analyst reviews /var/log/syslog and finds the following recurring entry every 10 minutes: 'CRON[4821]: (www-data) CMD (/tmp/.update.sh)'. The www-data account normally only serves web content and has no legitimate scheduled tasks. What does this log evidence most likely indicate?

Accepted Answer

A scheduled cron job is providing the attacker persistence by repeatedly executing a hidden script as the www-data user

Answer

The Apache service is automatically updating itself through its built-in maintenance routine

Answer

A brute-force login attempt against the www-data account is in progress

Answer

The kernel is logging a normal system time synchronization event