Back to evidence

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed
Confidence
99%
First seen
Aug 21, 1:49:56 PM PDT
Evidence through
Aug 21, 3:28:35 PM PDT
AI status
Complete
True positive99% confidence

Confirmed command-injection compromise of the responding workload. HTTP responses contained non-reflected root identity output despite HTTP 400 responses ([redacted]; [redacted]), and another injected request returned non-reflected kernel and OS-release data ([redacted]). Event-driven telemetry independently observed root dash processes and discovery children in the correlated workload ([redacted]; [redacted]; [redacted]; [redacted]). This validates the detector's immutable confirmed state for workload-level root execution, while not proving host escape, persistence, or request-to-process causality.

Attack stage
Initial access/exploitation with root execution, discovery, and follow-on tooling
Model
gpt-5.6-sol · 9 evidence calls

Observed impact

  • Root-level command execution occurred in the responding application workload (HTTP evidence [redacted] and [redacted]).
  • Kernel and operating-system information was disclosed to the requester (HTTP evidence [redacted]).
  • A root shell and child cat process targeted a sensitive file; successful file disclosure is not established (process evidence [redacted] and [redacted]).
  • Outbound-capable root shell processes were spawned, but no network connection or data transfer is proven (process evidence [redacted] and [redacted]).

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

1055 observations · 12 http
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

11 observations · 11 http
Http.server command output85%

Response contains non-reflected process identity output

2 observations · 2 http
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

13 observations · 12 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

16 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

22 observations · 12 process
Http.server kernel output97%

Response contains non-reflected kernel identification

1 observations · 1 http
Http.server os release output96%

Response contains non-reflected operating-system release data

1 observations · 1 http
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

2 observations · 2 process
Process.correlated network client80%

An outbound-capable client process appeared in the correlated workload and request window

2 observations · 2 process

Explicit uncertainty

  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Authorization is unknown; the activity could have originated from an authorized security test, although the technical command-execution consequence is real.
  • Routing affinity and time proximity do not provide a unique per-request trace edge to any process. HTTP response output independently proves execution in the responding workload.
  • No incident-cited flow event was available to the flow-evidence tool; therefore no outbound connection, destination, command-and-control channel, or exfiltration is established.
  • The sensitive-file command is observed, but available evidence does not establish whether file contents were successfully read or returned.
  • No cited evidence proves host escape, persistence, lateral movement, credential theft, or data exfiltration. Exact process exits would establish only process termination, not containment or remediation.

Recommended actions

  1. Immediately contain the affected workload and restrict its egress while preserving relevant HTTP, process, application, and network telemetry for forensic review.
  2. Remove the vulnerable endpoint from exposure or disable the affected feature, identify the command-injection flaw, and deploy a patched clean image rather than trusting the running instance.
  3. Because an application environment file and another sensitive target were probed, rotate workload secrets and credentials that may have been accessible, treating this as precautionary until access is scoped.
  4. Rebuild the workload with least privilege: run the application as non-root, use a read-only filesystem where feasible, minimize installed shells and network clients, and apply restrictive seccomp/AppArmor or equivalent controls.
  5. Review firewall, conntrack, DNS, proxy, and cloud-flow records around [redacted]–[redacted]50Z to determine whether the outbound-capable processes created connections or transferred data.
  6. Scope peer workloads and the parent application process for similar shell, discovery, sensitive-file, and network-client executions; investigate the full source-cluster activity while accounting for possible NAT or proxy aggregation.
  7. Preserve and analyze the affected image and writable layers for unauthorized modifications, but do not infer persistence from the current short-lived process evidence alone.