Confirmed compromise

Likely true positive for suspicious root-context execution inside the protected processor workload. Verified process telemetry shows a root dash shell spawning root discovery activity, followed later by repeated root shells classified as targeting sensitive files and additional discovery execution. Exact lifecycle evidence shows several processes exited, including zero exits, but that proves only process completion—not successful sensitive-data access or malicious intent. No HTTP- or flow-plane evidence reference was available to establish the originating action, actor, request causality, or network consequence.

The detector's immutable state is confirmed, and this assessment agrees. Repeated injection-shaped requests produced non-reflected server identity and kernel output showing UID 0/root execution on the responding workload, including in HTTP 400 responses; the status codes do not negate execution [redacted]. Event-driven telemetry also observed root shells, discovery commands, sensitive-file targeting, and operations on an inventory-resolved shared resource [redacted]. HTTP-to-process causality remains temporal/workload-based rather than a unique trace edge, so the verdict proves RCE in the responding workload but not host escape, persistence, lateral movement, C2, or exfiltration.

The incident is likely a true positive for suspicious command execution inside the protected workload. Event-driven telemetry independently observed repeated root-run dash shells, discovery-classified shell executions, and root-run cat processes targeting sensitive files. This is materially stronger than a payload-only alert, although maliciousness and initial access are not proven: no usable HTTP or flow evidence is cited, command arguments and file identities are unavailable, and legitimate administrative or workload activity remains possible.

Likely true positive for suspicious root-level workload activity, but not proof of remote exploitation. Event-driven process telemetry recorded a root dash shell and child shell, repeated root discovery-class env executions, and a root process associated with mutation of an inventory-resolved shared resource [redacted]. The first two shells exited successfully within milliseconds [redacted]. Attribution and intent remain unresolved because no correlated HTTP evidence or cited flow evidence is available and exact arguments are excluded from the summaries.

The incident reflects real, high-risk process activity in the protected image-host workload: root-run dash shells, a root cat child classified as targeting a sensitive file, and a root shell associated with mutation of an inventory-resolved shared resource. Exact lifecycle evidence also shows sampled shells exited, with both zero and nonzero outcomes. However, the available evidence does not establish who initiated the activity, whether it was authorized workload/administrative behavior, or whether exploitation occurred. No HTTP request is cited as correlated, and no cited flow evidence is available to assess network consequences. Escalation and workload-owner validation are warranted, but compromise cannot be adjudicated from these process observations alone.