Live public case
Observed workload execution
Last activity Sep 10, 5:00:04 PM PDT
criticalNot required
Evidence-grounded assessment
Not required
An event-driven shell execution was observed in a protected workload without correlated HTTP evidence
- Protected workloads
- Protected workload A
- Progression
- Within-workload activity
- Severity basis
- Maximum incident posture
Observed impact
- Correlated process exited
- Sensitive file access command observed
- Shell spawned
- Workload discovery process spawned
- Workload root shell
Recommended actions
Attack timeline
1 incident threads
Live progression remains visible; PII, native endpoints, hashes, and private identities do not.
- 1Suspicious activityopen
An event-driven shell execution was observed in a protected workload without correlated HTTP evidence