Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 21, 2:39:42 PM PDT
Evidence through
Aug 21, 2:39:42 PM PDT
AI status
Complete
Indeterminate90% confidence

Two distinct event-driven executions of the dash shell as root were directly observed in the same protected workload within about 159 ms [redacted]. This validates the detector's shell-spawn observation, but the available summaries expose neither command arguments nor sufficient parent context to determine purpose. The incident cites no HTTP or flow events that can be inspected, so exploitation, an originating actor/action, and network consequences cannot be established. The activity is therefore security-relevant but of indeterminate maliciousness.

Attack stage
Execution observed; exploit path and malicious intent undetermined
Model
gpt-5.6-sol · 5 evidence calls

Observed impact

  • Two root-context dash shell processes executed in the protected workload [redacted].
  • No further consequence is established by the cited evidence.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

2 observations · 2 process

Explicit uncertainty

  • The available process summaries do not expose command arguments, script content, working directory, parent executable identity, or exit events, so the shells' purpose and results are unknown.
  • No HTTP evidence event is cited by this incident; attempts to query the process IDs as HTTP IDs were rejected. No request-to-process origin or remote actor can be established.
  • No flow evidence event is cited by this incident; attempts to query the process IDs as flow IDs were rejected. Network activity or request-to-socket causality cannot be assessed.
  • The source key is a workload cluster and must not be interpreted as a uniquely identified person or remote agent.
  • It is unknown whether these root shell executions were expected image-host behavior, orchestration, health-check activity, authorized administration, or unauthorized execution.
  • There is no cited evidence proving persistence, host escape, lateral movement, command-and-control, or data access/exfiltration.

Recommended actions

  1. Identify the owning service and review its deployment specification, entrypoint, scheduled jobs, health checks, and approved administrative activity around 2026-08-21T21[redacted]42Z to determine whether dash execution as root is expected.
  2. Retrieve retained endpoint or workload audit telemetry for PIDs 1307499 and 1307566 and their parent processes 1307487 and 1300552, including executable identity, arguments, ancestry, files accessed, child processes, and exit status.
  3. Review workload and platform authentication/audit logs for changes or interactive sessions immediately preceding the executions; preserve relevant telemetry and the workload image for follow-up.
  4. If the executions are not promptly attributable to expected behavior, contain or replace the workload according to incident-response policy, rotate credentials accessible to it, and investigate sibling workloads derived from the same image.
  5. Consider enforcing a non-root runtime, restricting shell availability and exec access, and alerting on future shell launches with richer ancestry and argument capture where operationally safe.