Confirmed compromise

This is likely a true positive for repeated attempted exploitation, not proof of successful command execution. Two captured PUT requests to target privatekind, five minutes apart and associated with the same derived source cluster, each triggered the high-severity command-injection-attempt detector for shell metacharacters with command tokens [[redacted]; [redacted]]. The incident further attributes the second request to targeting an application environment file [[redacted]]. Both requests received HTTP 200 with empty response bodies, but status alone does not establish execution. No cited process or flow events were available to validate a workload consequence or outbound activity.

Confirmed remote command injection with successful root-level execution in the responding application workload. Non-reflected process-identity and kernel output in HTTP responses proves execution even though the responses were HTTP 400. Event-driven process telemetry independently shows root-run dash shells spawning id, uname, and hostname in matching windows. A public-web outbound flow was also observed from an inventory-attributed media-edge workload, but it is not causally linked to the requests or processor command execution. The detector's immutable state is confirmed and is consistent with the evidence.

Verified process telemetry shows a repeated pattern of root-run dash executions in one processor workload, including a discovery-classified shell and a two-process parent/child chain classified as both shell and network client. The first verified shell has a matching exit event moments later. This substantiates the detector's suspicious execution findings (process refs [redacted], [redacted], [redacted], and [redacted]). However, the bounded evidence does not establish malicious intent, an originating HTTP request, or any actual outbound connection. The verdict is therefore likely true positive for suspicious workload execution, not confirmed exploitation or compromise.

The incident is strongly supported as web-surface reconnaissance. The detector aggregated 58 unauthenticated requests across 32 unique paths, two methods, and eight path categories from one derived source cluster, with 32 rejected responses (HTTP evidence set [redacted] through [redacted]). Verified samples corroborate a rapid sequence of empty-body GET probes against distinct path hashes: the root returned 200, while several subsequent routes returned 404. This supports route enumeration but does not establish exploit execution or compromise. Authorization and the real actor behind the source cluster remain unknown.