Confirmed compromise

Confirmed command-injection compromise of the responding workload. HTTP responses contained non-reflected root identity output despite HTTP 400 responses ([redacted]; [redacted]), and another injected request returned non-reflected kernel and OS-release data ([redacted]). Event-driven telemetry independently observed root dash processes and discovery children in the correlated workload ([redacted]; [redacted]; [redacted]; [redacted]). This validates the detector's immutable confirmed state for workload-level root execution, while not proving host escape, persistence, or request-to-process causality.

High-integrity process telemetry confirms that a root-run `dash` execution occurred and was classified both as a shell and a sensitive-file tool with a sensitive target. The same PID then exited with outcome zero. This establishes suspicious execution and a sensitive-file command, but not malicious intent, exploitation, or successful access to file contents. No HTTP or flow evidence references are available in the incident to establish an originating request, actor, network consequence, or request-to-process/socket causality. The activity could therefore be unauthorized execution or legitimate workload/administrative behavior.

Two event-driven process records prove that separate dash shell processes executed as root in the same protected workload within about 177 ms (process evidence [redacted] and [redacted]). This validates the detector's observed shell-spawn consequence, but the available summaries do not expose commands, parent identities, initiating action, or a causal HTTP/flow chain. Root dash execution can represent either malicious command execution or legitimate workload/administrative automation, so exploitation or compromise cannot be adjudicated from the cited evidence.

A root-run dash process was directly observed in the protected processor workload and classified as both a shell and a sensitive-file tool with a sensitive target [redacted]. The same PID then exited with a zero outcome [redacted]. This validates the detector's suspicious process observations, but the bounded evidence does not expose the command, target, actor, or initiating action, and there is no cited HTTP or flow event available to establish exploitation, network consequence, or malicious intent. Legitimate workload or administrative execution therefore remains plausible.

Two distinct event-driven executions of the dash shell as root were directly observed in the same protected workload within about 159 ms [redacted]. This validates the detector's shell-spawn observation, but the available summaries expose neither command arguments nor sufficient parent context to determine purpose. The incident cites no HTTP or flow events that can be inspected, so exploitation, an originating actor/action, and network consequences cannot be established. The activity is therefore security-relevant but of indeterminate maliciousness.

Verified process telemetry establishes repeated root-level shell and discovery execution in the protected workload, including dash spawning id and dash spawning env, with exact zero-exit lifecycle evidence for sampled sequences [redacted]. This confirms execution and discovery consequences, but not unauthorized exploitation. No incident-cited HTTP or flow events were available for bounded inspection, and the process summaries do not establish the initiating action, actor, or authorization. The behavior could represent malicious post-exploitation or legitimate processor/administrative activity; the available evidence cannot distinguish them.

The detector’s immutable output is confirmed/confirmed_compromise, and the evidence supports that result. Command-injection-shaped HTTP requests were followed by responses containing non-reflected root identity and kernel output; notably, command output was present even in HTTP 400 responses, which proves execution in the responding workload rather than failure based on status alone [[redacted], [redacted], [redacted]]. Event-driven telemetry independently observed root dash shells, discovery utilities, sensitive-file tools, and shared-resource mutation in correlated workload windows [redacted]. This establishes successful remote command execution and post-exploitation activity within responding workloads. It does not establish host escape, persistence, exfiltration, lateral movement, or command-and-control.

The process activity is genuine and security-relevant: event-driven root dash executions occurred in the processor workload, an id discovery child was spawned, a later root shell targeted a sensitive file, and root processes executed and accessed a shared resource. However, the bounded evidence does not establish whether these actions were unauthorized or expected processor/administrative behavior. No usable HTTP or flow evidence was available to identify an originating action, actor, or network consequence. Accordingly, this is an indeterminate suspicious-execution incident rather than proven exploitation or compromise.

Likely true positive for suspicious privileged process activity inside the image-host workload, but not proof of an external exploit. Event-driven telemetry directly observed a root dash shell spawning a root cat process classified as targeting a sensitive file; both had exact, zero-outcome exits [redacted]. Additional root dash shells recurred from the same parent, and a later root dash execution was classified as discovery [redacted]. The available summaries do not expose command arguments, the sensitive target, authorization context, HTTP causality, or network consequences, so compromise scope and origin remain unresolved.