Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 20, 11:48:22 PM PDT
Evidence through
Aug 21, 12:06:11 AM PDT
AI status
Complete
Indeterminate95% confidence

The detector’s critical suspicious-activity finding is supported at the process-effect level: repeated event-driven root `dash` executions occurred in one workload, including a `dash` process classified as discovery/shell that parented a root `env` discovery process [redacted]. Exact lifecycle evidence shows sampled shells exited, including a zero exit for the first observed shell and a nonzero exit for the latest [redacted]. However, the bounded evidence exposes neither command arguments nor cited HTTP/flow events, so it cannot determine whether this was exploitation, authorized application behavior, or administration. Verdict: indeterminate rather than confirmed compromise or false positive.

Attack stage
Execution and limited environment discovery observed; origin and intent undetermined
Model
gpt-5.6-sol · 9 evidence calls

Observed impact

  • Root shell processes executed inside the protected workload [redacted].
  • A root `env` discovery process ran as a child of a discovery-classified shell [redacted].
  • Exact sampled shell lifecycles ended; one sampled exit was zero and the latest was nonzero [redacted].

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

15 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

16 observations · 12 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

2 observations · 2 process

Explicit uncertainty

  • No HTTP evidence event is cited by this incident, so the required HTTP evidence lookup could not establish an originating request or request-to-process causality.
  • No flow evidence event is cited by this incident, so the required flow evidence lookup could not assess network consequences or request-to-socket causality.
  • The bounded process summaries omit command arguments and output; the actual shell operations and the meaning of the `env` execution are unknown.
  • The shared source key denotes a workload cluster, not a known human or remote-actor identity.
  • The evidence does not establish whether the process activity was authorized application behavior, administration, or malicious execution.
  • No cited evidence proves persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Validate whether the workload owner expected the repeated root `dash` executions and the `env` child at the cited times; compare against deployment, scheduler, image-processing, and administrative records.
  2. Preserve the workload and parent-process telemetry, then obtain authorized command-line/audit records for PPID 3075746 and its children if available.
  3. Review the workload image and runtime configuration for legitimate components that invoke `dash`; document and baseline expected behavior if confirmed.
  4. If the activity is unauthorized or continues unexpectedly, contain the workload according to policy, rotate credentials accessible to it, and rebuild from a trusted image.
  5. Reduce future impact by running the workload as non-root where feasible and restricting unnecessary shell binaries, privileges, and outbound access.