Microsoft’s GSocket research had a line that stuck with me: inbound firewall rules don’t catch it, but egress filtering and outbound monitoring can. Both ends connect out to a relay. So here’s how I look at outbound traffic on my own boxes.
1. List established outbound connections, with the process
sudo ss -tnp state establishedLook at the peer address column and the users:((“name”,pid=…)) part. You want to recognize every process on that list. Add -u for UDP: sudo ss -tunp.
2. Check anything weird
ps -o pid,ppid,user,lstart,cmd -p <PID>
sudo ls -l /proc/<PID>/exeAttackers disguise GSocket as kernel threads. A real kernel thread shows its name in [brackets] and has no exe link. If something named like a kernel thread has a binary behind it, dig in.
3. Watch over time
watch -n 5 'sudo ss -tnp state established'4. Then lock egress down
Web servers rarely need to talk to the whole internet. Allow what they need (updates, DNS, your backup target) and drop the rest with nftables or your upstream firewall. Do it in a maintenance window with console access, because getting egress rules wrong will break updates.
If you find something, also check cron, systemd units and shell startup files. I covered that in How-To: Hunt for Persistence on a Linux Server.
God Bless, and May the Source Be with You!
