Sanitized live incident
Suspicious activity
Native source identity and targetable endpoints are private.
criticalopen
- Confidence
- 99%
- First seen
- Sep 10, 11:56:49 AM PDT
- Evidence through
- Sep 10, 11:58:10 AM PDT
- AI status
- Pending
AI investigation is Pending
Deterministic signals remain live while the bounded assessment completes.
Observed impact
- Correlated process exited
- Shell spawned
- Workload root shell
Deterministic signals
An event-driven shell execution was observed in a protected workload without correlated HTTP evidence
7 observations · 7 processA previously correlated process lifecycle exited
7 observations · 7 process