8088 attack against the port of yarn

reference:

https://www.cnblogs.com/qcloud1001/p/9173253.html

 

   Weekend monitoring software company, to monitor CDH two cluster nodes CPU usage too sudden rise in full.

 

Solving steps:

1 / Find the largest share of the CPU process, it found yarn from the user. And disguised as sysupdate

2 / crontab -l -u yarn, found