Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 23, 2:01:27 PM PDT
Evidence through
Aug 23, 2:16:03 PM PDT
AI status
Complete
Likely true positive88% confidence

Likely true positive for suspicious runtime activity in the protected workload, but not proof of a specific exploit or full compromise. Verified process telemetry shows repeated root dash shells, two root shell processes classified as network clients, root shell commands targeting sensitive files, and root discovery commands [redacted]. These behaviors are materially suspicious in combination. No incident-cited HTTP or flow event was available to establish an initiating request or actual outbound connection, and legitimate automation remains possible.

Attack stage
Execution and discovery; sensitive-file targeting and outbound-capable tooling observed
Model
gpt-5.6-sol · 11 evidence calls

Observed impact

  • Root shell execution occurred in the workload [redacted].
  • Root discovery and sensitive-file-targeting shell commands were executed [process:[redacted], process:[redacted], process:[redacted], process:[redacted]
  • Two root shell processes classified as network clients were spawned; an actual network connection is not established [redacted].
  • At least one observed shell exited nonzero shortly after execution; this establishes termination only, not the absence of other consequences [redacted].

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

103 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

103 observations · 12 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

2 observations · 2 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

3 observations · 3 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

2 observations · 2 process

Explicit uncertainty

  • No HTTP evidence reference is cited by this incident, so the originating action, request, and actor cannot be determined.
  • No flow evidence reference is cited by this incident; the network-client process classification does not establish that a socket connected or transferred data.
  • The bounded summaries omit exact command arguments and sensitive-file identities, preventing determination of command intent and whether file access succeeded.
  • The evidence does not establish whether the activity was authorized administration, expected workload automation, or malicious execution.
  • The source key represents a workload cluster rather than a guaranteed human or remote-actor identity.
  • No cited evidence proves persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Promptly validate the process activity with the workload owner and compare the timestamps and parent PID against deployment, maintenance, health-check, and administrative-exec records.
  2. If the activity is unauthorized or cannot be quickly explained, isolate or replace the workload while preserving relevant runtime, orchestrator, and audit telemetry.
  3. Review complete process lineage and approved automation associated with the common parent PID, including the exact commands and sensitive targets, using authorized internal telemetry.
  4. Review egress and DNS telemetry around [redacted]51Z to determine whether either network-client-class process established a connection or transferred data.
  5. Assess whether targeted files could contain credentials or secrets; if unauthorized access is confirmed or cannot be excluded, rotate exposed credentials according to incident-response policy.
  6. Harden the workload by avoiding root execution where feasible, restricting shell availability, limiting egress, and alerting on unexpected administrative exec sessions.