Câu 104: GCIH: GIAC Certified Incident Handler

An organization has an SSH server that was compromised. Given the following evidence, what most likely occurred?

1. A. The kworker thread was exploited using process injection
2. B. The SSH user account credentials have been compromised
3. C. An attacker uploaded a malicious python library to a well-known repository
4. D. An attacker accessed the system through a backdoor using netcat — đáp án hiện tại