Callum McMahon (cmcmahon) is an AI developer who had just been onboarded to work on a new LLM-based project at Maromalix Corp. On April 7, 2026, he was setting up his fresh workstation. While doing that, he noticed CPU usage spiked dramatically, the system became completely unresponsive, and shortly after — it crashed. After reboot, a triage was collected — and luckily, Callum had configured Sysmon earlier, giving us better visibility to work with. Dig in and find out what happened.
Before diving into the questions, here is why specific artifacts were chosen:
Sysmon logs (in /var/log/syslog): McMahon had configured Sysmon for Linux (sysmonforlinux v1.5.1) before the incident. Sysmon logs process creation (EventID 1), file creation (EventID 11), file deletion (EventID 23), network connections, and DNS queries. The Sysmon config (/etc/sysmon/sysmonconfig-export.xml) shows all event types are set to onmatch="exclude" with no exclusion rules — meaning everything was being logged. This gives us comprehensive visibility.
Bash history (/home/cmcmahon/.bash_history): Records the commands the user typed. No timestamps in this case (HISTTIMEFORMAT was not set), but the sequential order combined with Sysmon timestamps allows correlation.
Auth log (/var/log/auth.log): Records authentication events including sudo commands with timestamps.
Filesystem artifacts in [root]/: Actual files collected from the system, including the malicious .pth file itself and Python package metadata.
The triage was collected using UAC (Unix-like Artifacts Collector), an open-source incident response tool that automates the collection of forensic artifacts from Unix-like systems. The collection is named uac-ip-172-31-22-208-linux-20260407172738.
This naming tells us: the host IP was 172.31.22.208, it is a Linux system, and collection started at 2026-04-07 17:27:38 UTC.
| Directory | …
|---|