Back to evidence

Sanitized live incident

Attempted exploitation

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 18, 11:46:47 AM PDT
Evidence through
Aug 18, 12:00:18 PM PDT
AI status
Complete
True positive97% confidence

Verified HTTP evidence shows server-generated, non-reflected root/UID 0 identity output, which establishes server-side execution even though that response was HTTP 400 ([redacted]). Two additional requests contained shell metacharacters with command tokens ([redacted]; [redacted]). Workload telemetry independently recorded root-context dash/id execution and, immediately after the later request, a root dash-to-cat lineage targeting a sensitive file ([redacted]; [redacted]; [redacted]; [redacted]). This supports successful command injection with root-context command execution and discovery, beyond the detector's attempted-exploitation classification. Request-to-process attribution remains temporal/workload-based rather than a unique trace edge.

Attack stage
Initial access / command execution, followed by discovery and sensitive-file targeting
Model
gpt-5.6-sol · 12 evidence calls

Observed impact

  • Server-side command execution disclosed root/UID 0 identity output ([redacted]).
  • Root-context shell and identity-discovery processes executed in the workload ([redacted]; [redacted]).
  • A root-context shell spawned cat with a sensitive target; command execution is observed, but successful file reading or disclosure is not established ([redacted]; [redacted]).
  • An outbound-capable shell-class process executed as root and exited nonzero; no network connection is established by the available evidence ([redacted]; [redacted]).

Deterministic signals

Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

6 observations · 6 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

27 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

31 observations · 12 process
Http.server command output85%

Response contains non-reflected process identity output

4 observations · 4 http
Process.correlated network client80%

An outbound-capable client process appeared in the correlated workload and request window

4 observations · 4 process
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

8 observations · 8 http
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

2 observations · 2 process

Explicit uncertainty

  • Process correlation uses workload identity and temporal proximity; there is no unique per-request trace or request-to-process causality edge.
  • Downstream workload affinity is inferred from configured target routing rather than an observed per-request trace edge.
  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • No incident-cited flow event was available to the flow-evidence tool, so outbound connection establishment, destination, transfer, or command-and-control cannot be assessed.
  • The bounded evidence identifies sensitive-file targeting but does not reveal the exact target or prove that content was successfully read or returned.
  • No evidence establishes persistence, host escape, lateral movement, or data theft.

Recommended actions

  1. Immediately isolate or tightly restrict the affected workload while preserving HTTP, process, application, and orchestration telemetry for the incident window.
  2. Identify and remediate the vulnerable API input path: remove shell invocation where possible, use fixed argument arrays, enforce strict allowlists, and add regression tests for metacharacter injection.
  3. Rebuild or redeploy the workload from a trusted image after investigation; compare image, configuration, mounted volumes, and runtime state for unauthorized changes.
  4. Rotate credentials and secrets accessible to the workload, prioritizing any material that could reside in the sensitive target or environment.
  5. Remove root execution from the service where feasible; use a non-root identity, read-only filesystem, least-privilege mounts, and constrained capabilities/seccomp policies.
  6. Review egress telemetry and enforce workload egress allowlisting because an outbound-capable process was attempted, while avoiding assumptions that a connection succeeded.
  7. Hunt for similar command-injection requests and matching shell, discovery, network-client, or sensitive-file process activity across adjacent workloads and the same deployment.