Sanitized live incident
Suspicious activity
Native source identity and targetable endpoints are private.
criticalopen
- Confidence
- 99%
- First seen
- Sep 11, 3:06:54 PM PDT
- Evidence through
- Sep 11, 3:06:54 PM PDT
- AI status
- Pending
AI investigation is Pending
Deterministic signals remain live while the bounded assessment completes.
Observed impact
- Correlated process exited
- Shell spawned
- Workload root shell
Deterministic signals
An event-driven shell execution was observed in a protected workload without correlated HTTP evidence
1 observations · 1 processA previously correlated process lifecycle exited
1 observations · 1 process