Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 18, 11:06:14 PM PDT
Evidence through
Aug 18, 11:09:58 PM PDT
AI status
Complete
Likely true positive84% confidence

Verified process telemetry supports a likely true positive for suspicious execution and discovery inside the workload: event-driven root-context dash shells ran, and root-context id and hostname discovery processes were observed beneath shell lineage [redacted]. Exact matching exit telemetry shows sampled shell/discovery processes exited with zero outcomes, but that does not determine whether the activity was authorized or tie it to any HTTP request [redacted]. No incident-cited HTTP or flow events were available through the respective evidence tools, so exploitation origin, actor, and network consequences remain unproven.

Attack stage
Execution and workload discovery
Model
gpt-5.6-sol · 8 evidence calls

Observed impact

  • Root-context shell execution occurred in the protected workload [redacted].
  • Root-context identity and hostname discovery commands executed under observed parent lineage [redacted].
  • Sampled shell and discovery process lifecycles ended with zero exit outcomes [redacted].

Deterministic signals

Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

63 observations · 12 process
Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

82 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

102 observations · 12 process

Explicit uncertainty

  • No incident-cited HTTP event was available to the HTTP evidence tool, so there is no verified request-to-process causality, exploit vector, remote actor, or originating action.
  • No incident-cited flow event was available to the flow evidence tool, so outbound connectivity and network consequences cannot be assessed from this incident.
  • The bounded evidence does not expose command arguments, script contents, or authorization context; legitimate administration, workload automation, and security testing cannot be excluded.
  • The source key is a workload/traffic cluster and must not be treated as a unique human or agent identity.
  • Zero process exits establish completion of sampled processes, not benign intent, exploit success, or absence of other surviving processes.
  • No cited evidence proves host escape, persistence, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Promptly validate the shell and discovery executions against expected deployment hooks, health checks, administrative sessions, automation, and authorized security testing.
  2. If the activity is not immediately attributable, contain or restrict the affected workload according to operational policy while preserving process, container, and orchestrator telemetry.
  3. Investigate parent PID 3075746 and its workload role, image provenance, launch configuration, and associated orchestrator audit records.
  4. Review nearby process and filesystem telemetry for dropped files, credential access, configuration changes, persistence, or additional child processes.
  5. Review network telemetry for the workload during and after the incident window; the current incident provides no cited flow evidence.
  6. If unauthorized root execution is confirmed, rebuild from a trusted image and rotate credentials or secrets accessible to the workload.