Privacy-safe clusters, not actor count
Drost Defender · live public testbed
Live autonomous defense
Watch deterministic detection and evidence-grounded AI investigation respond to attacks against PrivateKind in real time.
Live Defender observing
Current assessment
Live compromise evidence requires attention
2 live-window cases contain confirmed server-side impact.
Live observation
Standing by for new attack activity
Observed updated at Aug 19, 3:57:24 PM PDT. Privacy-bearing source and endpoint details are removed.
- Requests
- 280
- Route patterns
- 152
- Connections
- 2
- Methods
- GET
Live-window operations
Proven execution or consequence
1 revisions pending
Live operations
Priority cases
Cases correlate independently preserved incident threads without erasing their evidence boundaries.
criticalAI assessment ready
Suspicious activity
Verified event-driven process telemetry shows repeated root-run dash shells in the protected workload, including child discovery utilities and a root-run cat process classified as targeting a sensitive file. This strongly supports unauthorized or attack-like command execution with discovery and sensitive-file access activity. However, no HTTP or flow evidence references are available to establish the initiating action, actor, exploit vector, request-to-process causality, network consequence, or whether the activity was authorized administration or lab automation.
criticalAI assessment ready
Suspicious activity
Likely true positive for suspicious in-workload execution, but not proof of a remote exploit. Event-driven telemetry shows repeated root-run dash executions, including discovery-classified activity, plus a root-run cat child targeting a sensitive file [redacted]. Exact lifecycle evidence shows the sensitive-targeting shell and cat exited nonzero, while other discovery/shell instances exited zero [redacted]. No cited HTTP or flow events were available to establish origin, request causality, actor identity, egress, or exploitation.
criticalAI assessment ready
Suspicious activity
Likely true positive for suspicious workload execution: event-driven telemetry directly observed multiple root-context dash shells, a root-context bash child shell, and root-context discovery executables (`id` and `hostname`) in one workload (process evidence [redacted], [redacted], [redacted], [redacted], [redacted]). This supports execution and discovery inside the workload, but not exploitation, remote-request causality, persistence, host escape, or data theft. The origin and authorization remain unresolved because no incident-cited HTTP or flow evidence was available.
criticalAI assessment ready
Suspicious activity
Verified process telemetry supports a likely true positive for suspicious execution and discovery inside the workload: event-driven root-context dash shells ran, and root-context id and hostname discovery processes were observed beneath shell lineage [redacted]. Exact matching exit telemetry shows sampled shell/discovery processes exited with zero outcomes, but that does not determine whether the activity was authorized or tie it to any HTTP request [redacted]. No incident-cited HTTP or flow events were available through the respective evidence tools, so exploitation origin, actor, and network consequences remain unproven.