Back to evidence

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed
Confidence
100%
First seen
Aug 27, 8:08:29 PM PDT
Evidence through
Aug 27, 9:20:52 PM PDT
AI status
Complete
True positive100% confidence

Confirmed remote command execution in the responding workload. A command-injection request received non-reflected process-identity output showing UID 0/root, which proves execution despite the HTTP 400 response (HTTP evidence [redacted]). Event-driven process telemetry immediately afterward recorded root shell and identity-discovery processes, and later recorded a root cat process targeting a sensitive file; those process events corroborate workload activity but are correlated by workload/time rather than uniquely attributable to the HTTP request.

Attack stage
Exploitation and root command execution; post-exploitation discovery and sensitive-file targeting
Model
gpt-5.6-sol · 9 evidence calls

Observed impact

  • Confirmed command execution as UID 0/root in the responding workload (HTTP evidence [redacted]).
  • Root dash and id executions were observed immediately after the proven exploit response (process evidence [redacted] and [redacted]).
  • A root cat process targeting a sensitive file was observed later in the same workload, but file contents, successful read, and request causality are not established (process evidence [redacted]).

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

2103 observations · 10 http
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

13 observations · 12 http
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

173 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

175 observations · 12 process
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

4 observations · 4 process
Http.server command output100%

Exploit request received non-reflected process identity output

1 observations · 1 http
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

2 observations · 2 process

Explicit uncertainty

  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • The direct HTTP evidence proves command execution in the responding workload, but routing affinity is not an observed per-request trace edge to a uniquely identified downstream process.
  • The process evidence is correlated by workload identity and time. Except for parent-child relationships within process telemetry, it does not uniquely prove which HTTP request created each process.
  • No flow evidence was cited by this incident and the attempted bounded flow lookup could not resolve the supplied cited HTTP event; outbound communication, destination novelty, command-and-control, and exfiltration therefore remain unassessed.
  • The evidence does not establish host escape, persistence, lateral movement, the contents or success of the sensitive-file read, or data theft.
  • Authorization is not established; broad enumeration could be an authorized test, but authorization would not change the technical finding that root command execution occurred.

Recommended actions

  1. Immediately isolate or remove the affected workload instances from untrusted traffic while preserving relevant logs and forensic state.
  2. Rotate credentials and secrets accessible to the responding workload, prioritizing any material potentially exposed by the sensitive-file command.
  3. Identify and patch or disable the vulnerable API path and command-construction behavior; avoid invoking shells with request-derived values and apply strict allow-list validation.
  4. Rebuild affected workloads from known-good images rather than relying only on process termination, then validate runtime configuration and least-privilege controls so the service does not execute as root.
  5. Review surrounding HTTP and process telemetry for the full incident interval, and acquire workload filesystem, secret-access, and platform audit evidence to determine what sensitive target was accessed and whether persistence or broader compromise occurred.
  6. Add or verify egress monitoring and flow retention for the affected workload because this incident contains no decision-relevant flow evidence.