Back to evidence

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed
Confidence
100%
First seen
Aug 28, 12:44:03 PM PDT
Evidence through
Aug 28, 1:20:51 PM PDT
AI status
Complete
True positive100% confidence

The detector's immutable state is confirmed, and this assessment agrees. Repeated injection-shaped requests produced non-reflected server identity and kernel output showing UID 0/root execution on the responding workload, including in HTTP 400 responses; the status codes do not negate execution [redacted]. Event-driven telemetry also observed root shells, discovery commands, sensitive-file targeting, and operations on an inventory-resolved shared resource [redacted]. HTTP-to-process causality remains temporal/workload-based rather than a unique trace edge, so the verdict proves RCE in the responding workload but not host escape, persistence, lateral movement, C2, or exfiltration.

Attack stage
Initial access via command injection; root execution and post-exploitation discovery/resource activity
Model
gpt-5.6-sol · 10 evidence calls

Observed impact

  • Remote commands executed as root in the responding workload, with server-returned identity output [redacted].
  • Kernel/system information was disclosed through non-reflected command output [redacted].
  • Root shell and discovery executions were observed in correlated workloads [redacted].
  • Sensitive-file targeting and mutation/access/execution operations on shared resource [redacted] were observed [process [redacted], [redacted], [redacted]
  • The same inventory-resolved shared resource was later executed/accessed by root processes in another observed workload [redacted].

Deterministic signals

Http.command injection attempt88%

Request contains shell metacharacters and command tokens

28 observations · 12 http
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

43 observations · 12 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

52 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

69 observations · 12 process
Http.server command output100%

Exploit request received non-reflected process identity output

6 observations · 6 http
Http.server kernel output97%

Response contains non-reflected kernel identification

4 observations · 4 http
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

3 observations · 3 process
Process.shared resource activity80%

A process modified an inventory-resolved resource attached to multiple workloads

8 observations · 8 process · 2 inventory
Http.state changing activity after compromise88%

A state-changing HTTP method was observed after confirmed workload compromise

1 observations · 1 http

Explicit uncertainty

  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Downstream workload affinity is inferred from configured routing; there is no observed per-request trace edge to a particular process.
  • Process correlation is based on workload identity and time proximity. No unique HTTP-request-to-process parentage edge is available.
  • No flow-plane evidence references are cited by this incident; the attempted bounded flow query could not resolve the supplied non-flow event IDs. Outbound C2, destination novelty, and exfiltration therefore cannot be assessed from this update.
  • The sensitive-file summaries do not expose the exact target or resulting contents, so successful secret collection or disclosure is not established.
  • Shared-resource mutation/access/execution is observed, but the exact changed material and whether it produced durable persistence are not established.
  • The post-compromise POST returned HTTP 400; no evidence proves that it changed application state, used stolen credentials, or represented an unauthorized identity.
  • No cited evidence proves host escape, persistence, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Immediately isolate the affected responding workloads and restrict access to shared resource [redacted] while preserving snapshots and relevant gateway/process telemetry.
  2. Redeploy affected workloads from known-good immutable images; do not rely only on terminating the observed short-lived processes.
  3. Diff and validate the shared resource against a trusted version, identify every attached workload, and inspect those workloads for unauthorized execution or altered material.
  4. Patch the command-injection path, add strict allow-list validation/encoding, and remove shell invocation from request processing where possible.
  5. Remove root execution from the exposed service, apply least privilege, read-only mounts, and workload isolation controls to limit shared-resource blast radius.
  6. Rotate credentials and secrets that were reachable by the affected workloads after scoping which sensitive files and environment material were accessible.
  7. Review retained network telemetry separately for outbound connections, novel destinations, or data transfer because this incident contains no usable flow evidence references.
  8. Hunt across the full interval for matching shell, discovery, sensitive-file, and shared-resource activity, and preserve evidence for root-cause analysis.