Back to evidence

Sanitized live incident

Attempted exploitation

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 28, 2:05:13 AM PDT
Evidence through
Aug 28, 2:37:48 AM PDT
AI status
Complete
True positive98% confidence

The incident is a true positive for successful command injection, not merely an attempt. Repeated malicious HTTP inputs were observed, including one targeting the system account database [[redacted]]. A captured HTTP response contained non-reflected server-generated identity output identifying UID 0/root even though the response status was 400 [[redacted]]; status therefore does not negate execution. Independent process telemetry recorded root shells, discovery, a sensitive-file command, and mutation/execution of the same shared resource in correlated workload contexts [redacted]. The HTTP-to-process relationship remains temporal/workload correlation rather than a unique per-request parentage edge, but the server-generated output directly establishes server-side root execution.

Attack stage
Command injection with root execution, discovery, sensitive-file access, and shared-resource modification
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • Server-side execution as UID 0/root was disclosed in captured HTTP output [[redacted]].
  • Root shell and discovery activity was observed in correlated workloads [redacted].
  • The same inventory-resolved shared resource was classified as mutated in one workload context and executed in another [redacted].
  • A root cat process targeted a sensitive file and its matched lifecycle exited zero; this establishes command completion but not data exfiltration [redacted].

Deterministic signals

Http.command injection attempt88%

Request contains shell metacharacters and command tokens

7 observations · 7 http
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

4 observations · 4 process
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

3 observations · 3 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

7 observations · 7 process
Process.correlated exit99%

A previously correlated process lifecycle exited

10 observations · 10 process
Http.server command output85%

Response contains non-reflected process identity output

1 observations · 1 http
Process.shared resource activity80%

A process modified an inventory-resolved resource attached to multiple workloads

5 observations · 5 process · 1 inventory

Explicit uncertainty

  • The source key is a derived traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Configured routing and temporal/workload correlation do not establish a unique HTTP-request-to-process causality edge.
  • No flow-plane event is cited by this incident; therefore outbound connections, command-and-control, or exfiltration cannot be assessed from the available evidence.
  • The bounded evidence does not reveal the sensitive file's contents or prove that its contents were returned or exfiltrated.
  • The exact content and durability of the shared-resource mutation are not exposed, so persistence and the full blast radius remain unproven.
  • There is no cited evidence proving host escape, lateral movement, persistence, or data theft.

Recommended actions

  1. Immediately restrict external access to the affected endpoint and isolate or cordon the implicated processor and image-host workloads while preserving evidence.
  2. Preserve workload snapshots, process telemetry, HTTP summaries, and the inventory-resolved shared resource before rebuilding affected workloads from trusted images.
  3. Compare shared resource [redacted] against a trusted baseline, remove unauthorized changes, and review every workload to which it is attached.
  4. Patch the vulnerable request-handling path; eliminate shell invocation for user-controlled data and enforce strict allowlists and structured argument passing.
  5. Review potentially exposed sensitive files and environment-derived secrets. Rotate credentials only where exposure is confirmed or reasonably suspected, prioritizing high-value service credentials.
  6. Hunt for the same payload behavior across targets and historical logs, treating the source key as a cluster rather than a definitive actor identity.
  7. Review network telemetry from the affected workloads for the incident window because no flow evidence was available in this incident, and escalate if suspicious outbound activity is found.