Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 18, 11:22:03 AM PDT
Evidence through
Aug 18, 11:22:44 AM PDT
AI status
Complete
Indeterminate88% confidence

Verified process telemetry establishes three root-context dash shell executions, each followed by a root-context id discovery process in the same workload (process evidence [redacted], [redacted], [redacted], [redacted], [redacted], [redacted]). Exact lifecycle evidence shows all six processes exited; the first pair had nonzero outcomes and the later four had zero outcomes (process evidence [redacted], [redacted], [redacted], [redacted], [redacted], [redacted]). This supports execution and discovery inside the workload, but not a malicious origin: the incident cites no HTTP or flow events, and the available summaries omit command arguments and authorization context. The detector's critical suspicious-activity output remains intact, while the available evidence is insufficient to distinguish exploitation from legitimate administrative or workload behavior.

Attack stage
Execution and discovery observed; originating action undetermined
Model
gpt-5.6-sol · 10 evidence calls

Observed impact

  • Root-context shell and identity-discovery processes executed inside the protected workload.
  • All six observed shell/discovery processes exited; four had zero outcomes and two had nonzero outcomes.
  • No observed network connection, persistence, host escape, lateral movement, command-and-control, or data theft is established by the cited evidence.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

3 observations · 3 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

1 observations · 1 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

6 observations · 6 process
Process.correlated exit99%

A previously correlated process lifecycle exited

6 observations · 6 process

Explicit uncertainty

  • No HTTP evidence reference is cited by this incident. HTTP evidence lookup using the cited process IDs was unavailable because those IDs are not HTTP-plane citations, so no originating request or request-to-process causality can be assessed.
  • No flow evidence reference is cited by this incident. Flow evidence lookup using the cited process IDs was unavailable because those IDs are not flow-plane citations, so no outbound connection or process-to-socket causality can be assessed.
  • The bounded process summaries do not expose command arguments, environment, terminal/session origin, or the identity and authorization context of the initiating actor.
  • The recurring parent PID is observed, but its executable, role, and legitimacy are not available in the cited evidence.
  • The source key is a workload cluster and does not identify a human or remote actor.
  • The evidence cannot determine whether these short-lived root shell/discovery sequences were exploitation, an authorized administrative action, a workload task, or security testing.

Recommended actions

  1. Verify the owner and expected behavior of parent PID 3076121 and determine whether it legitimately launches dash/id sequences in this workload.
  2. Review orchestrator exec/audit records, deployment events, application logs, and authorized maintenance or test activity around 2026-08-18T18[redacted]03Z through [redacted]44Z.
  3. Preserve relevant workload, node, control-plane, and authentication telemetry before retention windows expire; prioritize records that can reveal argv and initiating session provenance.
  4. If the activity is not authorized, contain or replace the workload from a known-good image and rotate secrets or credentials accessible to its root context.
  5. Reduce unnecessary root execution and interactive shell availability, and add process-to-HTTP and process-to-flow correlation telemetry where feasible.