An unusual outbound connection was detected from an internal host to a known malicious IP address. Further analysis revealed the installation of a backdoor that allows persistent access to the compromised system.