A service that restarts itself
An unfamiliar service on build-03 keeps reconnecting to an outside address. Use systemctl to find the unit, read the unit file, and identify the binary it starts.
Briefing
Egress logs show build-03 opening a connection to the same outside address roughly every thirty seconds whenever the previous one drops.
A service with Restart=always would behave like that. Units that administrators add live in /etc/systemd/system; packaged units live in /lib/systemd/system.
build-03 · Persistence hunting
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.