Confirmed compromise

The evidence supports the detector's reconnaissance finding: one derived source cluster sent a broad, rapid sequence of requests to target privatekind using multiple HTTP methods and distinct route hashes. Representative requests include GET, POST, and OPTIONS against API and other route categories, with varied 200/401/404/405/422 responses. This is consistent with automated surface and method enumeration. Authorization and source identity are unresolved, so the activity could be sanctioned testing or inventory rather than hostile reconnaissance. No process or flow evidence is cited by this incident, so no execution, persistence, lateral movement, outbound callback, or other post-reconnaissance consequence is established.

The captured HTTP transaction is consistent with an attempted command-injection attack: the complete 115-byte PUT request triggered the verified high-severity rule for shell metacharacters combined with command tokens. The request received HTTP 200 with an empty response, but status alone does not establish command execution. No cited process or flow evidence is available to demonstrate execution, outbound activity, persistence, or other post-exploitation consequences. Evidence: HTTP event [redacted] (SHA-256 [redacted]).

Incident [redacted] retains the detector's immutable confirmed/confirmed_compromise state. The verdict is independently supported by a command-injection request whose response contained non-reflected process-identity output and explicit command-input/process-output correlation showing UID 0/root (HTTP [redacted]). Root shell and discovery processes, plus a root sensitive-file tool, were also observed in the correlated workload (process [redacted], [redacted], [redacted]). The HTTP 400 responses do not negate execution because server-generated command output is present. Process timing/lineage corroborates workload activity but is not treated as a unique request-to-process causality edge.

Verified HTTP evidence shows server-generated, non-reflected root/UID 0 identity output, which establishes server-side execution even though that response was HTTP 400 ([redacted]). Two additional requests contained shell metacharacters with command tokens ([redacted]; [redacted]). Workload telemetry independently recorded root-context dash/id execution and, immediately after the later request, a root dash-to-cat lineage targeting a sensitive file ([redacted]; [redacted]; [redacted]; [redacted]). This supports successful command injection with root-context command execution and discovery, beyond the detector's attempted-exploitation classification. Request-to-process attribution remains temporal/workload-based rather than a unique trace edge.

The evidence strongly supports a genuine command-injection attempt against target privatekind: the verified HTTP event was flagged for shell metacharacters with command tokens [redacted]. About four seconds later, event-driven process telemetry recorded a root-run dash shell in the detector-correlated workload [redacted], and the same observed PID later exited with a zero outcome [redacted]. This materially strengthens the incident, but does not prove that this particular request created the shell because workload routing and temporal correlation are not a unique request-to-process edge. The HTTP 400 status does not itself establish success or failure. The immutable detector classification remains attempted_exploitation; the appropriate adjudication is likely true positive, with possible execution rather than conclusively request-attributed execution.