Back to evidence

Sanitized live incident

Attempted exploitation

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 19, 9:00:37 AM PDT
Evidence through
Aug 19, 10:41:50 AM PDT
AI status
Complete
True positive97% confidence

The evidence establishes successful server-side command execution, not merely an attempt. Three captured HTTP responses contained non-reflected process-identity output identifying root/UID 0 despite HTTP 400 statuses ([redacted], [redacted], [redacted]). Event-driven telemetry in the correlated workload also recorded root dash shells and child discovery/sensitive-file processes ([redacted], [redacted], [redacted], [redacted]). HTTP requests with shell metacharacters and command tokens occurred in the same time windows ([redacted], [redacted]). The evidence does not provide a unique request-to-process trace edge, prove sensitive-file contents were returned, or prove an outbound connection.

Attack stage
Command injection with root-level workload execution and discovery
Model
gpt-5.6-sol · 13 evidence calls

Observed impact

  • Confirmed root-level server-side command execution and process-identity disclosure ([redacted]; [redacted]; [redacted]).
  • Root shell, identity-discovery, and sensitive-target cat processes executed in the workload ([redacted]; [redacted]; [redacted]; [redacted]).
  • An outbound-capable root shell process spawned, but no network connection is established by available flow evidence ([redacted]).

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

737 observations · 2 http
Http.server command output85%

Response contains non-reflected process identity output

3 observations · 3 http
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

27 observations · 12 process
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

16 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

33 observations · 12 process
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

7 observations · 7 http
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

3 observations · 3 process
Process.correlated network client80%

An outbound-capable client process appeared in the correlated workload and request window

1 observations · 1 process

Explicit uncertainty

  • The evidence does not establish a unique per-request trace or parentage edge from any HTTP transaction to a process execution.
  • No flow event is cited by this incident; querying flow evidence with the process event was rejected. An actual outbound connection, destination, and request-to-socket causality therefore remain unproven.
  • The sensitive-target cat process is observed, but successful file-content retrieval, response disclosure, or exfiltration is not established; the associated shell lifecycle had a nonzero outcome.
  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Authorization is unknown; the activity could have occurred during sanctioned testing, but the technical behavior and execution consequences are real.
  • No evidence proves host escape, persistence, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Immediately contain or replace the affected workload while preserving process, application, gateway, and orchestration telemetry for forensic review.
  2. Identify and patch the command-injection path; disable unsafe shell invocation and validate all remotely supplied parameters against strict allowlists.
  3. Review the workload image and filesystem for unauthorized changes, dropped files, scheduled tasks, new credentials, and other persistence indicators before restoration.
  4. Rotate application secrets and credentials that could have been exposed through environment or sensitive-file access, prioritizing credentials available to the root-running workload.
  5. Review egress telemetry outside this incident window for the affected workload; no cited flow evidence here can confirm or exclude an outbound connection.
  6. Run the service as a non-root user, apply least-privilege filesystem permissions, and enforce restrictive workload egress policies.
  7. Determine whether the source cluster and activity were part of an authorized security test; if not, block or rate-limit the cluster using controls outside this investigation system.