Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 27, 11:08:14 PM PDT
Evidence through
Aug 27, 11:08:14 PM PDT
AI status
Complete
True positive97% confidence

Server-side command execution is directly evidenced: a captured GET response contained non-reflected process identity output identifying root/UID 0, despite returning HTTP 400 (HTTP evidence [redacted]). Process telemetry independently recorded two root `dash` executions classified as shell and discovery activity in the same workload and parent lineage (process evidence [redacted] and [redacted]). The second execution occurred during the HTTP transaction and exited successfully just before response completion (process evidence [redacted]), providing strong corroboration without establishing a unique request-to-process edge. The observed scope is workload-level root command execution and identity disclosure; host escape, persistence, lateral movement, outbound communication, and data theft are not established.

Attack stage
Execution and discovery in the workload; initial-access mechanism unresolved
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • Root/UID 0 process identity output was disclosed in an HTTP response [[redacted]].
  • Two root `dash` processes classified as shell and discovery activity executed in the workload [redacted].
  • Both cited shell lifecycles exited with outcome zero [redacted].

Deterministic signals

Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

2 observations · 2 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

2 observations · 2 process
Process.correlated exit99%

A previously correlated process lifecycle exited

2 observations · 2 process
Http.server command output85%

Response contains non-reflected process identity output

1 observations · 1 http

Explicit uncertainty

  • The exact request path, query string, and any triggering parameter are excluded from the bounded HTTP summary, so the specific injection vector and payload cannot be determined.
  • Workload/time correlation does not provide a unique request-to-process parentage edge. The first shell execution predates the cited HTTP transaction, while the second falls within it.
  • No flow evidence event is cited by this incident, so outbound connectivity, destination novelty, command-and-control, or exfiltration cannot be assessed.
  • The source key is a traffic cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Available evidence does not establish host escape, persistence, lateral movement, or data theft.

Recommended actions

  1. Immediately contain or replace the affected processor workload while preserving its process, application, and gateway telemetry for scoping.
  2. Disable or restrict the implicated API route until its input handling and command-execution path are reviewed and corrected; do not treat the HTTP 400 response as mitigation.
  3. Investigate parent PID 2212455 and the cited workload for additional child processes, file changes, credential access, and execution outside the retained incident window.
  4. Review independent network telemetry for the workload because this incident contains no cited flow evidence; block unexplained egress if found.
  5. Rotate credentials or tokens accessible to the workload's root context if follow-up review shows they may have been exposed, and reduce the workload's runtime privileges where feasible.