Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 27, 11:08:11 PM PDT
Evidence through
Aug 27, 11:08:11 PM PDT
AI status
Complete
Indeterminate90% confidence

Verified process telemetry shows a root-run dash execution classified as both shell and discovery in the protected workload [redacted]. Its exact lifecycle subsequently exited with outcome zero about 23 ms later [redacted]. This validates the detector's process observations, but the bounded evidence does not reveal the command or establish malicious intent, exploitation, or an originating HTTP request. No HTTP or flow evidence references are available in this incident for causality or network-impact analysis. The incident therefore remains suspicious but indeterminate rather than a demonstrated compromise.

Attack stage
Execution / Discovery — observed workload shell behavior; origin and intent unknown
Model
gpt-5.6-sol · 5 evidence calls

Observed impact

  • A root-run dash process classified as shell and discovery executed in the workload [redacted].
  • The observed process exited with a zero outcome; no continuing process impact is established by this lifecycle [redacted].

Deterministic signals

Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

1 observations · 1 process
Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

1 observations · 1 process
Process.correlated exit99%

A previously correlated process lifecycle exited

1 observations · 1 process

Explicit uncertainty

  • The bounded process summaries do not expose the executed command arguments, command output, or parent executable, so legitimacy and intent cannot be determined.
  • No HTTP evidence reference is cited by this incident; the originating action and any request-to-process relationship are unknown.
  • No flow evidence reference is cited by this incident; outbound network activity or request-to-socket causality cannot be evaluated.
  • The derived source key represents a workload cluster, not a proven human or remote actor identity.
  • A zero exit outcome indicates process completion but does not by itself prove either benign behavior or successful malicious objectives.
  • There is no cited evidence proving persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Review workload audit and application logs around 2026-08-28T06[redacted].728Z to recover the dash command, its parent process, triggering job or request, and any output.
  2. Compare the observed dash invocation and parent lineage with the processor workload's approved startup scripts, health checks, scheduled jobs, and administrative procedures.
  3. Preserve the relevant process, container, and orchestration telemetry and check for additional unusual child processes before the retention window expires.
  4. If the shell is not expected, restrict the workload's privileges, rotate credentials accessible to it, and consider containment after evaluating operational impact.
  5. Add command-line and parent-executable collection, where policy permits, and improve HTTP/process and process/flow correlation to resolve future events.