Back to evidence

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed
Confidence
100%
First seen
Aug 28, 3:23:33 PM PDT
Evidence through
Aug 28, 3:57:25 PM PDT
AI status
Complete
True positive100% confidence

The immutable detector state is confirmed, and the evidence supports that conclusion. A command-injection request returned non-reflected root/UID 0 process output and kernel identification in the same captured HTTP transaction, proving command execution despite HTTP 400 (HTTP [redacted]). A separate injection request returned non-reflected OS-release and kernel data (HTTP [redacted]). Event-driven process telemetry also observed a root dash shell spawning id and later root processes targeting a sensitive resource and performing mutation, execution, and access operations. HTTP-to-process attribution remains temporal/workload-based rather than a unique causality edge. No cited flow event was available, so outbound communication, C2, or exfiltration is not established.

Attack stage
Exploitation: command injection leading to root code execution and discovery
Model
gpt-5.6-sol · 8 evidence calls

Observed impact

  • Remote command execution as root/UID 0 in the responding workload (HTTP [redacted]).
  • Process identity, kernel, and operating-system information were disclosed (HTTP [redacted]; HTTP [redacted]).
  • Root shell/discovery processes were observed in the correlated workload (process [redacted]; process [redacted]).
  • Root process activity targeting a sensitive resource included observed mutation, execution, and access operations; unique request causality is not proven (process [redacted]; process [redacted]; e

Deterministic signals

Http.server command output100%

Exploit request received non-reflected process identity output

3 observations · 3 http
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

12 observations · 12 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

34 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

37 observations · 12 process
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

12 observations · 12 http
Http.server kernel output97%

Response contains non-reflected kernel identification

3 observations · 3 http
Http.server os release output96%

Response contains non-reflected operating-system release data

1 observations · 1 http
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

1 observations · 1 process
Process.shared resource activity80%

A process modified an inventory-resolved resource attached to multiple workloads

5 observations · 5 process · 1 inventory
Process.correlated network client80%

An outbound-capable client process appeared in the correlated workload and request window

1 observations · 1 process
Http.state changing activity after compromise88%

A state-changing HTTP method was observed after confirmed workload compromise

1 observations · 1 http

Explicit uncertainty

  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Downstream workload affinity is inferred from configured routing and is not an observed per-request trace edge.
  • Process correlation is based on workload identity and temporal proximity; it does not prove that any particular HTTP request created a specific process.
  • The responding workload's root execution is proven, but available evidence does not prove host escape, host compromise, or persistence.
  • The incident cites no flow-plane event. The attempted flow lookup found no cited flow evidence, so outbound connectivity, destination, C2, and exfiltration cannot be determined.
  • The later POST received HTTP 400; neither its method nor status establishes a successful state change or credential misuse.
  • Although resource mutation, execution, and access are observed, the bounded evidence does not establish the resource's contents, business impact, or attacker attribution through a unique request edge.

Recommended actions

  1. Immediately isolate or restrict the affected workload while preserving volatile process, filesystem, and application evidence.
  2. Replace the affected workload from a known-good image rather than relying only on process termination; validate the underlying host separately before returning service.
  3. Patch or disable the command-injection-vulnerable endpoint and enforce strict allowlist-based input validation without shell invocation.
  4. Review the mutated resource [redacted] and all workloads that can consume it; restore it from a trusted source if unauthorized modification is confirmed.
  5. Rotate credentials and secrets accessible to the affected workload, prioritizing those exposed through environment, mounted resources, or application configuration.
  6. Review retained network telemetry around 2026-08-28T22[redacted]33Z–[redacted]25Z for actual connections, destinations, transferred bytes, and signs of C2 or exfiltration.
  7. Hunt across related workloads for the cited process and HTTP evidence patterns, while treating the source key as a cluster rather than a guaranteed actor identity.
  8. Preserve the cited immutable evidence and correlate it with application logs, authentication logs, orchestrator audit events, and filesystem change records.