Live public case
Attempted exploitation
Last activity Aug 25, 8:12:13 PM PDT
Evidence-grounded assessment
Not required
A complete-capture POST request to target privatekind triggered the high-confidence command-injection-attempt rule for shell metacharacters combined with command tokens (HTTP evidence [redacted]). This supports a likely genuine exploitation attempt. The request received HTTP 200, but status alone does not prove command execution. No incident-cited process or flow evidence was available to establish downstream execution, outbound activity, or other compromise consequences.
- Protected workloads
- One protected workload
- Progression
- Within-workload activity
- Severity basis
- Maximum incident posture
Observed impact
- No confirmed execution or post-exploitation impact; the available evidence establishes an attempted command-injection request only.
Recommended actions
Attack timeline
1 incident threads
Live progression remains visible; PII, native endpoints, hashes, and private identities do not.
- 1Attempted exploitationopen
A complete-capture POST request to target privatekind triggered the high-confidence command-injection-attempt rule for shell metacharacters combined with command tokens (HTTP evidence [redacted]). This supports a likely genuine exploitation attempt. The request received HTTP 200, but status alone does not prove command execution. No incident-cited process or flow evidence was available to establish downstream execution, outbound activity, or other compromise consequences.