Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 18, 11:47:37 AM PDT
Evidence through
Aug 18, 12:28:52 PM PDT
AI status
Complete
Likely true positive84% confidence

Direct event-driven process telemetry supports real suspicious activity inside the workload: a root-run dash process classified as both shell and discovery spawned a root-run env child [redacted], similar root shell/discovery executions recurred later [redacted], and a root-run dash process classified as a shell and sensitive-file tool targeted a sensitive resource [redacted]. This makes the behavioral detection likely valid, but available evidence does not identify the initiating actor or distinguish malicious execution from authorized administrative/lab automation. No HTTP or flow evidence references were available to establish an ingress vector or network consequence.

Attack stage
Execution and discovery, with sensitive-file targeting
Model
gpt-5.6-sol · 9 evidence calls

Observed impact

  • Root-context shell and discovery processes executed within the protected workload.
  • A root-context shell process targeted a sensitive resource; access success or content disclosure is not proven.
  • At least one observed shell/discovery lifecycle exited successfully, but that does not establish the result of every command.

Deterministic signals

Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

13 observations · 12 process
Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

60 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

62 observations · 12 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

1 observations · 1 process

Explicit uncertainty

  • No HTTP evidence reference is cited by the incident, so an originating request, exploit attempt, and request-to-process causality cannot be assessed.
  • No flow evidence reference is cited by the incident, so outbound communication, destination novelty, or request-to-socket causality cannot be assessed.
  • The source key denotes a workload cluster rather than a verified person or remote actor.
  • The bounded process summaries expose behavioral classifications but not exact command arguments or file paths, so the precise discovery operations and sensitive target are unknown.
  • The evidence does not distinguish malicious activity from authorized administrative, test, or lab automation.
  • Sensitive-file targeting does not by itself prove successful read, modification, credential access, or disclosure.
  • No cited evidence proves persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Validate the recurring parent process and its owner against approved workload entrypoints, jobs, health checks, and administrative or attack-simulation activity.
  2. Preserve and review workload audit logs and application/orchestrator records around 2026-08-18T18[redacted]37Z–[redacted]41Z to identify the initiating action and exact commands.
  3. Review access telemetry for the sensitive resource and determine whether it was read, modified, or disclosed.
  4. If the activity is unauthorized, isolate or redeploy the affected workload using established procedures, revoke exposed workload credentials, and investigate the parent process lineage.
  5. Reduce workload privileges where feasible: avoid running the application as root, restrict shell/tool availability, and apply least-privilege filesystem and egress controls.
  6. Add or verify HTTP and flow telemetry coverage so future process activity can be correlated without inferring causality from timing alone.