Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 21, 2:13:25 PM PDT
Evidence through
Aug 21, 2:34:24 PM PDT
AI status
Complete
Indeterminate90% confidence

High-integrity process telemetry confirms that a root-run `dash` execution occurred and was classified both as a shell and a sensitive-file tool with a sensitive target. The same PID then exited with outcome zero. This establishes suspicious execution and a sensitive-file command, but not malicious intent, exploitation, or successful access to file contents. No HTTP or flow evidence references are available in the incident to establish an originating request, actor, network consequence, or request-to-process/socket causality. The activity could therefore be unauthorized execution or legitimate workload/administrative behavior.

Attack stage
Execution / possible sensitive-file access; origin unknown
Model
gpt-5.6-sol · 5 evidence calls

Observed impact

  • A root-run shell process was observed in the protected workload.
  • The process was classified as a sensitive-file tool with a sensitive target; actual read, disclosure, or modification of file contents is not established.
  • The observed process exited with outcome zero; no persistence, host escape, lateral movement, command-and-control, or data theft is demonstrated.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

3 observations · 3 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

3 observations · 3 process
Process.correlated exit99%

A previously correlated process lifecycle exited

3 observations · 3 process

Explicit uncertainty

  • The incident cites no HTTP event, so the originating action, request, and actor cannot be determined and no request-to-process causality can be established.
  • The available process summary is argument-free and does not expose the exact command, sensitive path, operation, or parent executable; intent and authorization cannot be determined.
  • The source key represents a workload cluster rather than a guaranteed human or agent identity.
  • No flow event is cited by the incident, so outbound network activity and request-to-socket causality cannot be assessed.
  • A root-run shell and sensitive-file command may be malicious, but could also be expected application, initialization, health-check, or administrative activity.
  • Exit outcome zero establishes only the observed process outcome, not successful access to or disclosure of sensitive file contents.

Recommended actions

  1. Identify PID 949979 and review authorized workload, orchestration, and application activity around 2026-08-21T21[redacted]25Z to determine why it spawned `dash`.
  2. Compare the execution with the workload's expected process baseline and approved maintenance or deployment activity.
  3. Review available file-audit telemetry for the sensitive target to determine whether it was opened, read, changed, or exported; preserve relevant logs and workload state.
  4. Scope adjacent process and network telemetry for related child processes, repeated sensitive-file activity, or unusual outbound connections without assuming causal linkage.
  5. If the execution is confirmed unauthorized, contain or redeploy the workload and rotate credentials or secrets that file-audit evidence shows may have been exposed.