Confirmed compromise

Confirmed remote command execution in the responding workload. A command-injection request received non-reflected process-identity output showing UID 0/root, which proves execution despite the HTTP 400 response (HTTP evidence [redacted]). Event-driven process telemetry immediately afterward recorded root shell and identity-discovery processes, and later recorded a root cat process targeting a sensitive file; those process events corroborate workload activity but are correlated by workload/time rather than uniquely attributable to the HTTP request.

Likely true positive for unauthorized or otherwise security-relevant workload execution, but not proof of an HTTP exploit. Event-driven telemetry shows root-context shell and discovery execution, an outbound-capable process class, a root shell/child command targeting a sensitive file, and mutation plus access of an inventory-resolved shared resource in the same processor workload [redacted]. This combination is substantially more suspicious than a shell spawn alone. However, no cited HTTP or flow event was available to establish an originating request, remote actor, or actual outbound connection, and the bounded evidence does not establish persistence, lateral movement, host escape, command-and-control, or exfiltration.

Verified event-driven process telemetry confirms repeated root-context dash shell execution in the protected image-host workload, including discovery-class activity and two network-client-class shell executions. Matching lifecycle evidence shows sampled shells exited quickly, with both zero and nonzero outcomes. However, the incident provides no retrievable HTTP or flow evidence to establish an originating request, actor, actual outbound connection, exploitation, or compromise. This is materially suspicious and warrants urgent validation, but process execution alone cannot distinguish unauthorized activity from legitimate workload or administrative automation.

Verified process telemetry shows a root-run dash execution classified as both shell and discovery in the protected workload [redacted]. Its exact lifecycle subsequently exited with outcome zero about 23 ms later [redacted]. This validates the detector's process observations, but the bounded evidence does not reveal the command or establish malicious intent, exploitation, or an originating HTTP request. No HTTP or flow evidence references are available in this incident for causality or network-impact analysis. The incident therefore remains suspicious but indeterminate rather than a demonstrated compromise.

Server-side command execution is directly evidenced: a captured GET response contained non-reflected process identity output identifying root/UID 0, despite returning HTTP 400 (HTTP evidence [redacted]). Process telemetry independently recorded two root `dash` executions classified as shell and discovery activity in the same workload and parent lineage (process evidence [redacted] and [redacted]). The second execution occurred during the HTTP transaction and exited successfully just before response completion (process evidence [redacted]), providing strong corroboration without establishing a unique request-to-process edge. The observed scope is workload-level root command execution and identity disclosure; host escape, persistence, lateral movement, outbound communication, and data theft are not established.