Back to evidence

Sanitized live incident

Opportunistic scan

Native source identity and targetable endpoints are private.

mediumopen
Confidence
96%
First seen
Aug 26, 9:34:42 AM PDT
Evidence through
Aug 26, 9:35:33 AM PDT
AI status
Complete
True positive98% confidence

This is a true positive for opportunistic PHP/WordPress web-shell path enumeration, not a confirmed compromise. The cited HTTP sequence contains repeated GET requests classified as PHP/WordPress probes from one traffic cluster over approximately 50 seconds (HTTP refs [redacted] through [redacted]). Retrieved examples were capture-complete, had empty request bodies, and returned consistent 404 responses. Those responses support rejection/non-discovery but, by themselves, do not prove that every possible exploit consequence was absent. No process- or flow-plane event references are cited by this incident, so execution and outbound-network consequences cannot be independently evaluated.

Attack stage
Reconnaissance / web-shell discovery scanning
Model
gpt-5.6-sol · 6 evidence calls

Observed impact

  • Observed impact is limited to handling rejected PHP/WordPress probe requests; cited HTTP examples returned 404 responses ([redacted], [redacted], [redacted]).
  • No command execution, persistence, lateral movement, command-and-control, or data theft is established by the available cited evidence.

Deterministic signals

Http.php webshell enumeration96%

Rapid enumeration of PHP and WordPress web-shell paths

27 observations · 12 http

Explicit uncertainty

  • The source key is a traffic/workload cluster, not a verified person or single agent; it may represent a proxy, NAT gateway, or multiple workers.
  • The incident cites no process-plane or flow-plane event IDs. Attempts to query those planes using the HTTP event IDs were rejected because those IDs are not cited there, leaving command execution and outbound connection consequences unverified.
  • Downstream workload affinity is inferred from configured target routing and is not an observed per-request trace edge.
  • Exact paths, query strings, headers, and raw bodies are intentionally unavailable in the bounded summaries, so the specific filenames and any request metadata beyond the verified categories cannot be independently examined.

Recommended actions

  1. Continue monitoring the source traffic cluster and target for follow-on requests, especially any accepted responses, uploads, authentication attempts, or command-like interactions.
  2. Verify that the probed PHP/WordPress paths and unnecessary administrative or upload endpoints are absent or access-controlled on the target.
  3. Review workload process and egress telemetry for the incident window if available through authorized systems; escalate only if correlated execution, file changes, or novel outbound activity is independently established.
  4. Rate-limit or block the traffic cluster at the gateway if activity persists and doing so is consistent with operational policy; account for possible proxy/NAT sharing before applying broad controls.