Live Drost Defender

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed

AI investigation is Pending

Deterministic signals remain live while the bounded assessment completes.

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

150160 observations · 12 http

Http.server command output100%

Exploit request received non-reflected process identity output

6 observations · 6 http

Http.command injection attempt88%

Request contains shell metacharacters and command tokens

409 observations · 12 http

Http.server kernel output97%

Response contains non-reflected kernel identification

4 observations · 4 http

Http.server os release output96%

Response contains non-reflected operating-system release data

2 observations · 2 http

Http.state changing activity after compromise88%

A state-changing HTTP method was observed after confirmed workload compromise

1 observations · 1 http

Http.php webshell enumeration96%

Rapid enumeration of PHP and WordPress web-shell paths

1301 observations · 12 http

Http.authenticated activity after compromise90%

Authenticated HTTP activity was observed after confirmed workload compromise

1 observations · 1 http