Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 21, 11:05:58 AM PDT
Evidence through
Aug 21, 12:31:36 PM PDT
AI status
Complete
Likely true positive88% confidence

Likely true positive for unauthorized or malicious workload execution. Event-driven telemetry shows a root dash shell classified for discovery spawning root id ([redacted]; [redacted]), a later root shell classified as an outbound-capable client ([redacted]), and root dash/head processes targeting sensitive files ([redacted]; [redacted]). This strongly supports real shell execution, discovery, and sensitive-file targeting inside the processor workload, but not a specific exploitation path. No incident-cited HTTP or flow evidence was available to identify an originating request, actor, or actual network connection.

Attack stage
Execution and discovery with sensitive-file targeting
Model
gpt-5.6-sol · 9 evidence calls

Observed impact

  • Root shell and discovery execution occurred in the protected workload ([redacted]; [redacted]).
  • Root processes targeted sensitive files ([redacted]; [redacted]).
  • An outbound-capable client-classified shell was spawned, but no connection is established by the available evidence ([redacted]).
  • The sampled initial shell exited successfully; this proves completion of that lifecycle, not persistence or request causality ([redacted]).

Deterministic signals

Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

1868 observations · 12 process
Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

11987 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

12789 observations · 12 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

2 observations · 2 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

203 observations · 12 process

Explicit uncertainty

  • No HTTP evidence reference is cited for this incident, so the originating request, exploit mechanism, remote actor, and request-to-process causality cannot be determined.
  • No flow evidence reference is cited for this incident. The network-client classification does not prove that a socket connected, what destination was involved, or that data was transferred.
  • The bounded process summaries omit exact arguments and sensitive paths; the specific files targeted and whether their contents were disclosed are unknown.
  • No workload allowlist, job-queue context, deployment intent, or administrator audit evidence was available. A processor designed to run commands could produce similar telemetry legitimately, although the observed combination remains highly suspicious.
  • Exact process exits establish lifecycle completion only. The evidence does not prove persistence, host escape, lateral movement, command-and-control, or exfiltration.
  • The source key represents a workload cluster and must not be treated as a unique human or remote-agent identity.

Recommended actions

  1. If this command pattern is not explicitly expected, contain or restrict workload [redacted] while preserving volatile and process evidence.
  2. Review scheduler, job-queue, orchestration, and administrator audit records for the workload and parent process around [redacted]–[redacted]09Z to identify the initiating action.
  3. Under authorized access, inspect full process arguments and file-audit records to identify the sensitive targets and determine whether contents were read or exported.
  4. Review network telemetry around [redacted]56Z and the broader incident window; apply least-privilege egress controls even if no connection is ultimately found.
  5. Reduce runtime privilege: avoid root execution, restrict shell availability, and remove discovery/network utilities when not required by the processor role.
  6. If targeted files contained credentials or tokens, rotate only the affected secrets after confirming scope; otherwise avoid indiscriminate rotation.
  7. Hunt for the same parent lineage and process pattern across workloads using the same image or processor role, and validate whether it is documented operational behavior.