Back to evidence

Sanitized live incident

Attempted exploitation

Native source identity and targetable endpoints are private.

highopen
Confidence
88%
First seen
Aug 22, 10:57:49 AM PDT
Evidence through
Aug 22, 10:57:49 AM PDT
AI status
Complete
Likely true positive86% confidence

The incident is best assessed as a likely genuine command-injection attempt, not a demonstrated compromise. The verified HTTP event reports a POST request whose captured body triggered the command-injection rule for shell metacharacters plus command tokens [redacted]. The server returned 301 with an empty response body, but status and response shape do not establish whether execution occurred. No cited process or flow event was available to substantiate command execution or downstream network activity.

Attack stage
Attempted exploitation — HTTP command injection
Model
gpt-5.6-sol · 5 evidence calls

Observed impact

  • No command execution, persistence, lateral movement, outbound connection, or data loss is established by the available cited evidence.
  • Observed impact is limited to receipt and handling of one suspicious HTTP request; the response was a 301 with an empty body [http:[redacted]].

Deterministic signals

Http.command injection attempt88%

Request contains shell metacharacters and command tokens

1 observations · 1 http

Explicit uncertainty

  • The bounded HTTP summary does not expose the raw request content, so benign-context explanations for the metacharacters and command tokens cannot be fully excluded.
  • No process evidence ID is cited by this incident, so command execution and process consequences cannot be adjudicated from process telemetry.
  • No flow evidence ID is cited by this incident, so outbound network consequences cannot be adjudicated from conntrack telemetry.
  • The source key is a traffic cluster and may represent a proxy, NAT gateway, or multiple workers rather than one human or agent.
  • Target routing provides inferred workload affinity, not an observed per-request trace edge.

Recommended actions

  1. Preserve the cited HTTP event and correlate it with application, reverse-proxy, and workload logs around 2026-08-22T17[redacted]49Z using trusted server-side request identifiers where available.
  2. Review the affected handler and redirect behavior to determine whether request parameters can reach shell execution or unsafe command-building code.
  3. Search workload process telemetry around the event for unexpected shell or utility execution, while avoiding claims of request-to-process causality without a trace edge.
  4. Review outbound network telemetry around the event for unusual connections, while treating temporal correlation and destination novelty as supporting rather than causal evidence.
  5. Validate input handling and apply allow-list validation plus parameterized, non-shell APIs where command construction is unnecessary.