Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 23, 8:56:09 PM PDT
Evidence through
Aug 23, 9:14:26 PM PDT
AI status
Complete
Likely true positive86% confidence

Likely true positive for unauthorized or otherwise security-relevant execution inside the workload. Event-driven telemetry shows repeated root-run dash shells, including shells classified as targeting sensitive files, plus execution/access involving an inventory-resolved shared resource and subsequent discovery activity [redacted]. Exact lifecycle evidence shows sampled processes exited, mostly successfully; this does not negate the observed executions [redacted]. No cited HTTP or flow event is available to establish an originating request, actor, or outbound consequence, so exploitation causality and broader compromise remain unproven.

Attack stage
Execution with sensitive-resource access and workload discovery
Model
gpt-5.6-sol · 10 evidence calls

Observed impact

  • Root-run shell processes executed inside the protected workload [redacted].
  • Multiple shell executions were classified as targeting sensitive files [redacted].
  • A shared resource was executed and accessed by workload processes, creating potential exposure to other attached workloads, although no propagation is proven [process:[redacted], process:[redacted]

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

83 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

87 observations · 12 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

3 observations · 3 process
Process.shared resource activity92%

A process executed or interpreted content from an inventory-resolved resource attached to multiple workloads

6 observations · 6 process · 1 inventory
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

15 observations · 12 process

Explicit uncertainty

  • No HTTP evidence event is cited by the incident, so the initiating request, user action, or actor cannot be identified and request-to-process causality cannot be established.
  • No flow evidence event is cited by the incident, so outbound communication, destination novelty, command-and-control, and exfiltration cannot be assessed.
  • The bounded summaries do not expose exact command arguments or sensitive file paths; the data accessed and whether it contained credentials or secrets are unknown.
  • The source key is a workload cluster rather than a guaranteed person or remote-agent identity.
  • The evidence does not distinguish malicious activity from authorized administration, diagnostics, scheduled processing, or a security test; workload owner validation is required.
  • No evidence proves host escape, persistence, lateral movement, propagation through the shared resource, or data theft.

Recommended actions

  1. Promptly validate the activity with the workload owner and review deployment, scheduler, CI/CD, and administrative records for the observed times.
  2. If the executions are not expected, isolate or pause the affected workload using established response procedures while preserving process, container, orchestration, and application telemetry.
  3. Investigate the persistent parent process associated with the shell bursts and reconstruct its ancestry and trigger source from retained platform telemetry.
  4. Inspect shared resource [redacted] for unauthorized modifications and scope all workloads attached to it for matching execution or access patterns.
  5. Identify the sensitive targets from fuller endpoint telemetry; rotate exposed credentials or secrets only if access to secret-bearing material is confirmed or cannot be safely excluded.
  6. Reduce workload privilege where feasible, prevent unnecessary root execution, and restrict write/execute permissions on shared resources.