Hudak’s Honeypot (Part 3)

This is part three in a series. Follow these links for part one and part two. During our triage of the UAC data from the honeypot, we noted a process hierarchy running from the deleted /var/tmp/.lo…