A malicious script was executed on the host machine to establish persistence and escalate privileges. The script was initiated by the user 'jbinns' from an external IP address known for malicious activities.