Phoenix - Your AI AssistantLinux incident response / sysadmin
- Posted:
- Proposals: 4
- Remote
- #4467355
- Open for Proposals
have already sent a proposal. Description
Experience Level: Entry
Hi,
I’m looking for an experienced Linux incident response / sysadmin to help with a server issue.
A Linux server previously had an xmrig miner infection. Most artefacts have been removed, but something on the system is still intermittently attempting to download a miner script via wget.
The application code has been thoroughly checked and appears clean. This looks like a system-level persistence issue (cron, systemd service/timer, user-level service, SSH abuse, etc.).
What I’m looking for:
• Identify and remove the persistence mechanism
• Confirm whether there is any evidence of data access/exfiltration
• Advise whether the server is safe to keep or if a rebuild is recommended
Context:
• Ubuntu server
• Node.js / Next.js app
• PM2
• auditd already enabled
• Sensitive app secrets will be rotated after the work
Credentials WILL be checked prior to work commencing
I’m looking for an experienced Linux incident response / sysadmin to help with a server issue.
A Linux server previously had an xmrig miner infection. Most artefacts have been removed, but something on the system is still intermittently attempting to download a miner script via wget.
The application code has been thoroughly checked and appears clean. This looks like a system-level persistence issue (cron, systemd service/timer, user-level service, SSH abuse, etc.).
What I’m looking for:
• Identify and remove the persistence mechanism
• Confirm whether there is any evidence of data access/exfiltration
• Advise whether the server is safe to keep or if a rebuild is recommended
Context:
• Ubuntu server
• Node.js / Next.js app
• PM2
• auditd already enabled
• Sensitive app secrets will be rotated after the work
Credentials WILL be checked prior to work commencing
New Proposal
Login to your account and send a proposal now to get this project.
Log inClarification Board Ask a Question
-
There are no clarification messages.