Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 28, 12:51:06 PM PDT
Evidence through
Aug 28, 12:53:48 PM PDT
AI status
Complete
Likely true positive84% confidence

The incident is likely a true positive for suspicious command execution inside the protected workload. Event-driven telemetry independently observed repeated root-run dash shells, discovery-classified shell executions, and root-run cat processes targeting sensitive files. This is materially stronger than a payload-only alert, although maliciousness and initial access are not proven: no usable HTTP or flow evidence is cited, command arguments and file identities are unavailable, and legitimate administrative or workload activity remains possible.

Attack stage
Execution with discovery and sensitive-file targeting in workload
Model
gpt-5.6-sol · 15 evidence calls

Observed impact

  • Root-run shell processes were observed inside the workload.
  • Commands classified as targeting sensitive files were executed; successful file reads or disclosure were not established.
  • Discovery-classified shell processes were spawned.
  • Selected correlated processes exited, with both zero and nonzero outcomes; those exits do not establish request causality.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

26 observations · 12 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

13 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

30 observations · 12 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

2 observations · 2 process

Explicit uncertainty

  • No HTTP-plane evidence reference is available for this process-only incident, so the originating request, initial-access method, and remote actor cannot be determined.
  • No flow-plane evidence reference is available, so outbound connectivity, command-and-control, lateral movement, and exfiltration cannot be assessed.
  • The bounded process summaries exclude exact command arguments and sensitive file identities; the specific discovery actions and targeted files are unknown.
  • Process telemetry does not establish whether this activity was unauthorized. A legitimate workload task, operator action, or security test remains possible.
  • The source key is a workload cluster, not a proven human or remote-agent identity.
  • No evidence proves host escape, persistence, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Promptly validate whether the root shell, discovery, and sensitive-file activity was expected for this image-host workload and approved by an operator or automation job.
  2. If the activity is not immediately attributable, contain or restrict the affected workload using normal incident-response procedures while preserving process, orchestrator, and application telemetry.
  3. Investigate the common parent process lineage, deployment history, scheduled jobs, operator access, and workload audit records around 2026-08-28T19:51Z–19:54Z.
  4. Review sensitive-file audit and application logs to determine which files were targeted and whether reads succeeded; rotate exposed credentials only if access or disclosure is substantiated.
  5. Review available network telemetry for the same workload and interval to identify any related egress, while avoiding attribution based only on temporal proximity.