Observed workload execution

Likely genuine command-injection exploitation activity. Multiple HTTP requests carried shell metacharacters and command tokens, while root-run dash shells and child discovery commands were observed in the routed workload during the same narrow windows (HTTP [redacted]; process [redacted] and [redacted]). A whoami child completed successfully, and later root shell/head chains targeted sensitive files. This strongly supports execution in the workload, but the evidence supplies only workload/time correlation—not a unique request-to-process trace edge. Authorization is unknown, and no cited flow evidence establishes actual outbound communication.

Likely true positive for suspicious post-start execution inside the processor workload, but not proof of an external exploit or actor identity. Verified telemetry shows repeated event-driven, root-context dash execution, a shell classified as targeting a sensitive file, execution/access/mutation involving the same shared resource, and outbound-capable shell processes [redacted]. This combination is materially suspicious, although the evidence cannot determine whether it was authorized processor behavior. No incident-cited HTTP or flow event was available to establish an initiating request or an actual network connection.

Verified event-driven process telemetry substantiates the detector’s core observations: root-run dash shells spawned, root-run id discovery occurred as a shell child, and later root-run activity mutated, accessed, and executed an inventory-resolved shared resource (process evidence [redacted], [redacted], [redacted], [redacted], [redacted]; inventory evidence [redacted]). This is materially suspicious and has potential cross-workload relevance. However, the incident cites no HTTP or flow-plane events, and the bounded process summaries do not provide command arguments, authorization context, or a malicious causality edge. Because an image-host may legitimately use root shells and shared resources, the evidence cannot currently distinguish compromise from expected automation or administration.

Verified process telemetry supports a real suspicious execution sequence in the protected processor workload: event-driven root dash shells repeatedly ran, and associated activity accessed and mutated an inventory-resolved shared resource. The observed processes were short-lived and exited successfully, but successful exit does not make the activity benign. The available evidence does not identify the initiating actor or action, and no cited HTTP or flow events are available to establish a remote exploit, request-to-process causality, or network consequences. This is therefore likely a true positive for unauthorized or anomalous workload execution and shared-resource modification, not proof of broader compromise.