Back to evidence

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed
Confidence
100%
First seen
Aug 28, 11:35:31 AM PDT
Evidence through
Aug 28, 12:15:56 PM PDT
AI status
Complete
True positive100% confidence

The detector's immutable state is confirmed with classification confirmed_compromise, and the evidence supports that result: an exploit request/response exchange returned non-reflected process identity output showing root/UID 0, proving command execution in the responding workload despite HTTP 400. Root shell and discovery executions, sensitive-file-targeting commands, and outbound-capable process activity were also observed in correlated workload/time windows. The evidence does not establish host escape, persistence, data theft, or actual outbound socket activity.

Attack stage
Successful exploitation and root-level execution, followed by discovery and sensitive-file targeting
Model
gpt-5.6-sol · 12 evidence calls

Observed impact

  • Confirmed remote command execution as root within the responding workload.
  • Root shell and identity-discovery processes executed in correlated workloads.
  • Root processes targeted a sensitive file; successful disclosure or theft of its contents is not established.
  • Outbound-capable processes appeared, but no network flow was available to prove an outbound connection.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

338 observations · 12 http
Http.server command output100%

Exploit request received non-reflected process identity output

4 observations · 4 http
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

83 observations · 12 process
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

41 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

96 observations · 12 process
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

28 observations · 12 http
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

45 observations · 12 process
Process.correlated network client80%

An outbound-capable client process appeared in the correlated workload and request window

2 observations · 2 process

Explicit uncertainty

  • Source key [redacted] is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Authorization is not established; the traffic could theoretically be an authorized security test, although the technical detection of successful root command execution is well supported.
  • Downstream workload affinity is inferred from target routing and is not an observed per-request trace edge.
  • Process correlations use workload identity and temporal proximity; they do not uniquely prove which HTTP request created each process.
  • No incident-cited flow event was available for retrieval, so actual outbound connectivity, destination, command-and-control, and exfiltration are unproven.
  • Sensitive-file process telemetry establishes targeting but does not show the file contents, whether the read succeeded, or whether data left the workload.
  • There is no cited evidence proving host escape, persistence, lateral movement, or compromise beyond the responding/correlated workloads.

Recommended actions

  1. Immediately contain or replace the affected target and correlated workloads, while preserving HTTP, process, container/runtime, and application evidence for scoping.
  2. Disable or restrict the vulnerable API route and remediate the command-injection flaw; use strict structured argument handling rather than shell invocation and validate all untrusted inputs.
  3. Review workload images, mounted volumes, runtime configuration, and parent services for unauthorized changes; rebuild from trusted artifacts rather than relying only on process termination.
  4. Inventory and rotate credentials, tokens, and secrets accessible to the affected root-running workloads, prioritizing values exposed through environment variables or mounted sensitive files.
  5. Review retained network, DNS, proxy, and egress logs around the incident window to determine whether the outbound-capable processes made connections or transferred data.
  6. Scope all requests associated with the source cluster without treating it as a guaranteed individual identity; coordinate with asset owners to determine whether any activity was authorized testing.
  7. Reduce workload privileges, avoid running request-processing services as root, enforce read-only filesystems where feasible, and apply outbound network policy and least-privilege secret mounts.