Back to evidence

Sanitized live incident

Opportunistic scan

Native source identity and targetable endpoints are private.

mediumopen
Confidence
96%
First seen
Aug 24, 12:09:05 PM PDT
Evidence through
Aug 24, 12:09:21 PM PDT
AI status
Complete
True positive98% confidence

The incident is a true positive for opportunistic reconnaissance: a single derived traffic cluster rapidly issued GET requests categorized as PHP or WordPress probes, and the detector derived 39 requests across 20 unique probe paths in roughly 4.5 seconds. The available HTTP evidence shows only redirects or rejection responses and does not establish successful web-shell access or code execution. This verdict confirms the scan/enumeration activity, not host compromise. No process- or flow-plane evidence is cited by the incident, so downstream execution and network consequences remain unverified.

Attack stage
Reconnaissance: PHP/WordPress web-shell path enumeration
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • Brief unsolicited enumeration traffic reached target privatekind.
  • No successful exploitation or workload consequence is established by the available evidence.
  • All detector-recorded HTTP outcomes were redirects or rejections.

Deterministic signals

Http.php webshell enumeration96%

Rapid enumeration of PHP and WordPress web-shell paths

151 observations · 12 http

Explicit uncertainty

  • The incident cites no process-plane event IDs; process evidence queries therefore could not verify whether any execution occurred during the HTTP burst.
  • The incident cites no flow-plane event IDs; flow evidence queries therefore could not verify any workload-attributed outbound connection or destination novelty.
  • The bounded HTTP summaries exclude raw response bodies, so the 404 status and body metadata cannot independently rule out server-generated output.
  • Source_key is a traffic or workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Downstream workload affinity is inferred from configured target routing and is not an observed per-request trace edge.

Recommended actions

  1. Retain the gateway rejection/redirect controls and monitor for follow-on requests from the same source cluster or similar probe patterns.
  2. Review application and reverse-proxy logs around 2026-08-24T19[redacted]05Z–[redacted]10Z for any accepted follow-on requests, unusual PHP execution, file changes, or authentication activity.
  3. Confirm that unnecessary PHP/WordPress endpoints are not exposed and that any deployed components and plugins are current.
  4. Escalate to workload containment or forensic collection only if independent process, file, authentication, or network evidence indicates successful access.