Triage: Name the Active Attacker Connection

First-responder triage on a live host. A snapshot of current sockets was captured to /root/triage/connections.txt (the output of ss -tanp — all TCP sockets, listeners included). Among normal traffic, one ESTABLISHED connection is the attacker's interactive session to a high remote port.

Identify the attacker's REMOTE IP and record it to /root/case/attacker_ip.txt. Legitimate lines (localhost, the web server on :443, DNS) are noise — the outlier is an ESTABLISHED session from a shell-like local process to an external host. Grading checks the recorded IP: the file must name exactly one address (just the IP, or a uniq -c-style count followed by it), not a copy of the capture.