Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 28, 7:32:02 PM PDT
Evidence through
Aug 28, 8:12:15 PM PDT
AI status
Complete
Likely true positive84% confidence

Verified process telemetry shows a repeated pattern of root-run dash executions in one processor workload, including a discovery-classified shell and a two-process parent/child chain classified as both shell and network client. The first verified shell has a matching exit event moments later. This substantiates the detector's suspicious execution findings (process refs [redacted], [redacted], [redacted], and [redacted]). However, the bounded evidence does not establish malicious intent, an originating HTTP request, or any actual outbound connection. The verdict is therefore likely true positive for suspicious workload execution, not confirmed exploitation or compromise.

Attack stage
Execution and discovery; possible network-client preparation, origin unattributed
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • Root-context shell processes executed inside the protected processor workload.
  • A discovery-classified shell process executed.
  • Two shell processes classified as outbound-capable network clients executed in a parent/child chain.
  • At least one observed shell completed shortly after execution; this does not negate that execution occurred.
  • No proven outbound socket, persistence, host escape, lateral movement, command-and-control, or data theft.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

29 observations · 12 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

1 observations · 1 process
Process.correlated exit99%

A previously correlated process lifecycle exited

29 observations · 12 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

2 observations · 2 process

Explicit uncertainty

  • No HTTP evidence reference is available for this incident, so the originating request or action and any request-to-process causal link are unknown.
  • No flow evidence reference is available, so the network-client classifications do not establish that a socket connection occurred or identify any destination.
  • The bounded summaries exclude exact arguments and command contents; the specific discovery action and intended network operation cannot be determined.
  • The repeated shells may have been produced by legitimate processor or administrative automation; authorization and workload design context are unavailable.
  • The source key denotes a workload cluster and does not identify a human or remote actor.
  • The evidence does not establish persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Validate whether the processor workload is expected to launch repeated root-run dash processes and outbound-capable clients from the observed parent lineage.
  2. Review retained workload/application and orchestration audit logs around 2026-08-29T02[redacted]02Z–[redacted]08Z to identify the initiating job, API action, operator, or automation.
  3. If this behavior is unauthorized, isolate or replace the affected workload instance using established response procedures and preserve relevant process, application, and orchestration evidence.
  4. Apply least privilege: run the workload as a non-root user where feasible and restrict shell/tool availability to operationally required components.
  5. Review and enforce workload egress policy; investigate any independently retained network telemetry for connections around the two network-client executions.
  6. Avoid attributing the activity to a remote actor or declaring compromise until authorization context or causal evidence is obtained.