Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 23, 7:44:33 PM PDT
Evidence through
Aug 23, 7:44:59 PM PDT
AI status
Complete
Indeterminate90% confidence

Verified process telemetry shows three short-lived root executions of the dash shell in the same workload, all sharing the same parent PID and each followed by a zero-outcome exit. This establishes shell execution but not malicious exploitation. The incident contains no correlated HTTP evidence, and no incident-cited flow evidence was available; command arguments, parent identity, initiating actor/action, and authorization context are therefore unresolved. The detector's critical suspicious-activity output is preserved, but the available evidence cannot distinguish compromise from legitimate workload or administrative behavior.

Attack stage
Execution observed; initiating vector and authorization unknown
Model
gpt-5.6-sol · 9 evidence calls

Observed impact

  • Three root-context dash shell processes executed in the protected workload.
  • All three observed shell processes exited with a zero outcome; no persistence, host escape, lateral movement, command-and-control, or data theft is established.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

3 observations · 3 process
Process.correlated exit99%

A previously correlated process lifecycle exited

3 observations · 3 process

Explicit uncertainty

  • No HTTP evidence is cited by the incident, so the initiating request or other triggering action cannot be determined.
  • No flow evidence is cited by the incident, so outbound network consequences and request-to-socket causality cannot be assessed.
  • The bounded process summaries do not expose command arguments or the executable/identity associated with parent PID 2212046.
  • Whether these root shell invocations were expected application behavior, scheduled automation, or authorized administration is unknown.
  • The source key denotes a workload cluster and does not identify a human or remote actor.

Recommended actions

  1. Identify parent PID 2212046 from workload runtime and orchestration telemetry, and verify whether spawning dash is expected for that component.
  2. Review deployment manifests, entrypoints, health checks, scheduled jobs, and administrative automation around the three timestamps.
  3. Retrieve retained command-line, audit, and application logs for the matching PIDs without exposing secrets, and determine what each shell executed.
  4. Confirm whether root execution is required; if not, apply least privilege and restrict shell availability in the workload image.
  5. If the activity is unauthorized or recurs without explanation, contain the workload and preserve forensic telemetry; otherwise document and tune the expected behavior narrowly.