Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 24, 9:40:52 AM PDT
Evidence through
Aug 24, 10:48:50 AM PDT
AI status
Complete
Likely true positive86% confidence

The incident is likely a true detection of materially suspicious in-workload execution, but not proof of a specific remote exploit or actor. Event-driven telemetry shows multiple root-run dash shells, shell-classified outbound-capable clients, later root discovery and sensitive-target tooling, and access to an inventory-resolved shared resource. The progression and repeated activity across roughly 14 minutes are unlikely to be explained by one isolated shell launch. However, no HTTP event or conntrack event is cited by the incident, so the initiating action, authorization status, remote-request causality, and whether the outbound-capable processes actually opened connections remain unresolved. Exact exit joins show some processes terminated, but do not negate the observed execution or prove request causality.

Attack stage
Workload execution and discovery; possible sensitive-resource access
Model
gpt-5.6-sol · 13 evidence calls

Observed impact

  • Root-level shell execution occurred inside the protected workload.
  • Outbound-capable shell processes were spawned, but no corresponding network flow is established.
  • Discovery and sensitive-target process activity occurred as root; successful reading or disclosure is not established.
  • A child process accessed an inventory-resolved shared resource; modification or cross-workload propagation is not established.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

132 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

134 observations · 12 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

5 observations · 5 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

2 observations · 2 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

2 observations · 2 process
Process.shared resource activity92%

A process accessed an inventory-resolved resource attached to multiple workloads

1 observations · 1 process · 1 inventory

Explicit uncertainty

  • No HTTP evidence reference is available in the incident. The originating action, actor, remote exploit path, and request-to-process causality cannot be determined.
  • No flow evidence reference is available in the incident. The network-client classifications do not establish that a connection occurred, where it went, or whether data moved.
  • The evidence does not reveal whether the root process activity was authorized administrative or workload behavior; authorization and expected-baseline context are unavailable.
  • Sensitive-target process classification does not establish that data was successfully read, collected, or exfiltrated.
  • Shared-resource access does not establish modification, persistence, lateral movement, or effects in another workload.
  • The source key denotes a workload cluster and must not be treated as a uniquely identified human or remote actor.

Recommended actions

  1. Promptly validate the process lineage and parent PID against the image-host workload's expected entrypoint, scheduler, health checks, and authorized administrative activity.
  2. If the activity is not immediately explainable, isolate or replace the affected workload using established response procedures while preserving process, container, and orchestration evidence.
  3. Review workload and orchestration audit records around 16:40–16:55Z for exec/attach operations, job launches, credential use, and configuration changes.
  4. Review retained network telemetry for the network-client process times; do not infer destinations or data transfer from process classification alone.
  5. Inspect the sensitive and shared resources for read/write history and integrity changes, and assess other workloads attached to the shared resource without assuming propagation occurred.
  6. Reduce unnecessary root execution, restrict administrative exec paths, and apply least-privilege access to shared resources after operational validation.