Back to evidence

Sanitized live incident

Opportunistic scan

Native source identity and targetable endpoints are private.

mediumopen
Confidence
96%
First seen
Aug 27, 2:16:09 AM PDT
Evidence through
Aug 27, 2:16:16 AM PDT
AI status
Complete
True positive98% confidence

The incident is a true positive for opportunistic reconnaissance: a single derived traffic cluster rapidly issued GET requests categorized as PHP/WordPress probes across differing path hashes. The cited HTTP samples received only 301 redirects or 404 responses. This establishes hostile-style web-shell path enumeration, but not successful exploitation or compromise. No process or flow evidence was cited by the incident, so workload-side execution, outbound activity, persistence, or other consequences cannot be determined from the available evidence.

Attack stage
Reconnaissance — PHP/WordPress web-shell path enumeration
Model
gpt-5.6-sol · 6 evidence calls

Observed impact

  • Exposure to rapid web-shell path probing; no successful exploitation or workload consequence is established by the cited evidence.

Deterministic signals

Http.php webshell enumeration96%

Rapid enumeration of PHP and WordPress web-shell paths

62 observations · 12 http

Explicit uncertainty

  • The source key is a traffic/workload cluster and may correspond to a proxy, NAT gateway, multiple workers, or another shared source; it is not a verified actor identity.
  • The incident cites only HTTP-plane evidence. Process and flow evidence queries could not resolve the HTTP event IDs as process/flow events, so command execution, outbound connections, persistence, lateral movement, and data access cannot be confirmed or excluded.
  • Downstream workload affinity is inferred from configured target routing rather than an observed per-request trace edge.
  • The bounded HTTP evidence omits exact paths and raw response bodies; path categories and hashes support enumeration, but do not reveal which specific shell names were tested or independently establish application state.

Recommended actions

  1. Keep the source cluster under observation and apply proportionate gateway rate limiting or temporary blocking if the enumeration recurs, accounting for the possibility of shared NAT or proxy infrastructure.
  2. Review application and workload telemetry for the incident window for unexpected PHP execution, file creation or modification, authentication anomalies, and unusual child processes; preserve relevant logs.
  3. Verify that no unauthorized PHP files or web shells exist in deployed web roots and WordPress-related directories, and remove or disable unused PHP/WordPress components.
  4. Maintain generic 404/rejection behavior for nonexistent probe paths and avoid exposing diagnostic details that could help enumeration.