Confirmed compromise

True positive confirmed compromise: captured exploit/response evidence shows command-oriented input followed by non-reflected root identity and kernel output in the responding workload, despite HTTP 400 [[redacted]; [redacted]]. Event-driven telemetry independently observed root shells and discovery processes in the correlated workload [redacted]. The detector's immutable state is confirmed, and the inspected evidence supports that result. Later sensitive-target and network-client-class processes increase concern, but request-to-process and request-to-socket causality remain unproven [redacted].

Three event-driven process records confirm root-context `dash` shell executions in the same workload, all with parent PID 2212455 [redacted]. Matching lifecycle records show all three PIDs subsequently exited with outcome zero [redacted]. This proves shell execution inside the workload, but the available argument-free summaries do not identify the commands or actor. No HTTP or flow evidence IDs are cited by the incident, so exploitation and network consequences cannot be established. The behavior could represent malicious execution or legitimate processor/administrative activity.

Likely true positive command-injection exploitation with workload-level execution. Multiple HTTP requests were classified as containing shell metacharacters and command tokens, and root-context dash processes appeared tens of milliseconds later in the correlated processor workload. The strongest examples include dash spawning the discovery utilities id and uname as direct children. This repeated request/exec pattern strongly supports successful command execution, although routing affinity and temporal correlation do not provide a unique per-request causality edge. No cited flow evidence was available, so outbound communication, command-and-control, and exfiltration are not established.

Process telemetry conclusively shows repeated root-level dash execution in the processor workload, including discovery-classified shells and a final root dash→id parent-child chain [redacted]. Exact PID-matched lifecycle evidence also shows sampled shells exiting, generally successfully [redacted]. These are real execution consequences, but the bounded evidence does not establish whether they were authorized processor behavior or malicious activity. No usable HTTP or flow evidence was cited, so initial access, actor, request causality, network consequences, and compromise cannot be determined.