Back to evidence

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed
Confidence
100%
First seen
Aug 23, 1:52:20 PM PDT
Evidence through
Aug 23, 2:16:33 PM PDT
AI status
Complete
True positive100% confidence

The immutable detector output remains state=confirmed/classification=confirmed_compromise for incident [redacted], and the evidence supports that verdict. HTTP requests containing command-injection behavior received non-reflected root identity and kernel output, directly proving command execution in the responding workload even though the responses were HTTP 400 (HTTP [redacted] and [redacted]). Event-driven process telemetry independently observed root shell and discovery processes in the correlated workload window (process [redacted] and [redacted]). Additional correlated activity included a network-client-class shell, a sensitive-targeting shell, and execution/access involving a shared resource. These process observations strengthen the compromise assessment but do not establish a unique HTTP-request-to-process causal edge.

Attack stage
Exploitation and root command execution, followed by discovery and resource access
Model
gpt-5.6-sol · 11 evidence calls

Observed impact

  • Proven root-level remote command execution and identity/kernel information disclosure in the responding workload [HTTP:[redacted]; HTTP:[redacted]].
  • Root shell and identity-discovery processes were observed in the correlated workload window [redacted].
  • A root shell classified as an outbound-capable network client was observed, but no cited flow proves that it made a connection [redacted].
  • A root shell targeting a sensitive resource and shared-resource execution/access activity were observed; actual secret disclosure and the full integrity impact are not established [process:[redacted]; process:eb7d5274f

Deterministic signals

Http.server command output100%

Exploit request received non-reflected process identity output

4 observations · 4 http
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

14 observations · 12 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

35 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

48 observations · 12 process
Http.server kernel output97%

Response contains non-reflected kernel identification

2 observations · 2 http
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

20 observations · 12 http
Process.correlated network client80%

An outbound-capable client process appeared in the correlated workload and request window

1 observations · 1 process
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

6 observations · 6 process
Process.shared resource activity80%

A process executed or interpreted content from an inventory-resolved resource attached to multiple workloads

15 observations · 11 process · 1 inventory

Explicit uncertainty

  • Process correlation is based on workload identity and time proximity; there is no unique HTTP-request-to-process parentage edge.
  • No conntrack/flow evidence reference is cited by this incident. The flow query could not establish any outbound connection, destination, transferred data, or request-to-socket causality.
  • The source key is a traffic cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Downstream workload affinity is inferred from configured routing rather than an observed per-request trace edge.
  • Sensitive-targeting process telemetry does not prove that file contents were successfully read or disclosed.
  • The inspected evidence does not establish host escape, persistence, lateral movement, command-and-control, or data theft.
  • Shared-resource execution and access are observed, but the affected content and full integrity impact are not established by the bounded summaries.

Recommended actions

  1. Immediately isolate or remove the affected responding and correlated processor workloads from service while preserving snapshots and relevant telemetry; redeploy from a known-good immutable image.
  2. Patch the vulnerable endpoint and eliminate construction of shell commands from remote input. Apply strict allow-list validation and safe non-shell APIs.
  3. Stop running the exposed service as root; enforce a non-root UID, read-only root filesystem, least-privilege capabilities, seccomp/AppArmor, and narrowly scoped mounts.
  4. Inspect the referenced shared resource and sensitive targets for unauthorized changes or disclosure, comparing them with trusted baselines and backups.
  5. Review retained DNS, proxy, firewall, and conntrack telemetry for the incident window to determine whether the outbound-capable process made connections. Restrict workload egress pending review.
  6. Rotate credentials and secrets accessible to the affected workloads where exposure cannot be excluded, and review their use after the incident began.
  7. Hunt for the same request behavior and process lineage across workloads, treating the source key only as a traffic cluster rather than a definitive actor identity.