Back to evidence

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed
Confidence
100%
First seen
Aug 26, 10:55:29 AM PDT
Evidence through
Aug 26, 1:28:04 PM PDT
AI status
Complete
True positive100% confidence

The immutable detector state is confirmed, and the evidence supports that conclusion. A command-injection request received non-reflected process-identity output identifying uid 0/root, proving remote command execution in the responding workload even though the HTTP response was 400 (HTTP evidence [redacted]). Event-driven process telemetry independently observed root-run dash discovery/shell activity in the correlated workload, followed later by root process activity labeled as shared-resource mutation/access and sensitive-file targeting. The latter process observations are correlated by workload and time, not by unique per-request causality, so they are treated as observed post-exploitation activity with attribution uncertainty rather than definitive consequences of a specific request. No incident-cited flow event was available for retrieval, so outbound networking, command-and-control, and exfiltration are not established.

Attack stage
Successful exploitation and root execution, with correlated post-exploitation discovery and resource access
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • Remote command execution occurred as uid 0/root in the responding workload.
  • Server process identity was disclosed in an HTTP response.
  • A root-run shell/discovery process was observed in the correlated workload.
  • Root process telemetry recorded mutation and access operations against the same inventory-resolved shared resource; unique request causality is not established.
  • Root shell and cat activity targeted a sensitive file; actual content disclosure or exfiltration is not proven.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

496 observations · 12 http
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

8 observations · 8 http
Http.server command output100%

Exploit request received non-reflected process identity output

1 observations · 1 http
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

5 observations · 5 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

21 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

26 observations · 12 process
Process.shared resource activity80%

A process modified an inventory-resolved resource attached to multiple workloads

5 observations · 5 process · 1 inventory
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

2 observations · 2 process

Explicit uncertainty

  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Authorization is not established; broad enumeration can occur during sanctioned testing, although the technical compromise and root execution are proven.
  • Downstream workload affinity is inferred from configured routing rather than an observed per-request trace edge.
  • Process correlations use workload identity and time proximity; they do not prove unique HTTP-request-to-process parentage.
  • No incident-cited flow event was available to get_flow_evidence; outbound connectivity, destination novelty, command-and-control, and exfiltration therefore remain unknown.
  • The bounded summaries do not identify the sensitive file or disclose its contents, and they do not establish data theft.
  • Host escape, persistence, lateral movement, and compromise beyond the responding workload are not proven.
  • Observed exits apply only to their exactly matched process lifecycles and do not establish full containment or attacker eviction.

Recommended actions

  1. Immediately isolate or remove the affected workload from service while preserving volatile and persistent evidence for forensic review.
  2. Rebuild or redeploy the workload from a known-good image after collecting evidence; do not rely solely on the observed short-lived process exits.
  3. Identify and patch the vulnerable API handler or command-construction path, and prevent untrusted request data from reaching a shell.
  4. Review the full application, gateway, and process timeline around 2026-08-26T19[redacted]32Z–[redacted]40Z to scope all commands and affected objects.
  5. Validate the integrity of the referenced shared resource, determine what was changed or read, and inspect all workloads attached to it.
  6. Determine which sensitive file was targeted and whether its contents or derived credentials were exposed; rotate workload-accessible secrets where exposure cannot be excluded.
  7. Review retained network telemetry for outbound connections from the affected workload because no usable flow evidence was present in this incident.
  8. Confirm whether the activity was authorized security testing; regardless, remediate the root-execution path and reduce the workload from root to least privilege.
  9. Harden the endpoint with strict allow-list validation, safe non-shell APIs, authentication and authorization checks, and proportional gateway detections or rate limits.