Question

While reviewing a compromised Linux web server, an analyst opens /var/log/auth.log and finds the following entry:

'Aug 14 02:17:44 web01 sudo: www-data : TTY=pts/1 ; PWD=/var/www/html ; USER=root ; COMMAND=/bin/bash'

Which event does this log entry BEST indicate?

Accepted Answer

The www-data service account used sudo to spawn an interactive root shell, indicating likely privilege escalation

Answer

A scheduled cron job ran a routine backup script as root without user interaction

Answer

The root user logged in directly over SSH and opened a Bash session

Answer

A failed authentication attempt was recorded for the www-data account