Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Oct 5, 12:06:49 PM PDT
Evidence through
Oct 5, 2:15:15 PM PDT
AI status
Failed
AI investigation is Failed

Deterministic signals remain live while the bounded assessment completes.

Observed impact

  • Correlated process exited
  • Outbound client spawned
  • Sensitive file access command observed
  • Shared resource access observed
  • Shared resource execution observed
  • Shared resource mutation observed
  • Shell spawned
  • Workload discovery process spawned
  • Workload root shell

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

8098 observations · 12 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

2914 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

8193 observations · 12 process
Process.shared resource activity92%

A process modified an inventory-resolved resource attached to multiple workloads

82 observations · 11 process · 1 inventory
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

98 observations · 12 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

15 observations · 12 process