Confirmed compromise

The immutable detector state is confirmed, and the evidence supports that conclusion. A command-injection request returned non-reflected root/UID 0 process output and kernel identification in the same captured HTTP transaction, proving command execution despite HTTP 400 (HTTP [redacted]). A separate injection request returned non-reflected OS-release and kernel data (HTTP [redacted]). Event-driven process telemetry also observed a root dash shell spawning id and later root processes targeting a sensitive resource and performing mutation, execution, and access operations. HTTP-to-process attribution remains temporal/workload-based rather than a unique causality edge. No cited flow event was available, so outbound communication, C2, or exfiltration is not established.

Real process activity is confirmed, but malicious intent or compromise is not. Event-driven telemetry directly observed root-run dash shells in the processor workload, including repeated shells from the same parent lineage. An exact lifecycle record shows one observed shell exited successfully. Separate root-run processes accessed a shared resource. However, no HTTP or flow evidence is cited, and the bounded summaries do not expose command arguments, resource contents, or an initiating actor. The short-lived, repeated shell pattern could be normal worker or administrative activity. Exploitation, persistence, host escape, lateral movement, command-and-control, and data theft are not established.

Likely true positive for suspicious workload-level execution, but not a proven externally initiated exploit. Event-driven telemetry directly observed repeated root-run dash shells, discovery activity, a sensitive-file-targeting shell, and execution from an inventory-resolved shared resource in the same workload context [redacted]. The repeated common parent PID may indicate an application service or administrative automation rather than a remote actor, and no HTTP or flow evidence was available to establish origin, request-to-process causality, or network consequences. At least one observed shell had an exact exit event with a zero outcome; that establishes process completion only, not benign intent or exploit causality [redacted].