Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 27, 7:54:16 PM PDT
Evidence through
Aug 27, 7:58:17 PM PDT
AI status
Complete
Indeterminate86% confidence

Verified process telemetry shows repeated root-context dash execution in one processor workload, including five dash-to-env parent/child pairs, followed by zero-status exits. The stable parent, repeated pattern, short lifetimes, and clean exits are compatible with an intentional workload task, health/diagnostic routine, or administrative automation; they do not by themselves prove exploitation. Conversely, root shell execution and environment discovery could be unauthorized. No request origin, actor attribution, command arguments, authorization context, or decision-relevant network consequence is available, so compromise cannot be confirmed or ruled out. The detector's critical suspicious-activity output is therefore preserved, but the investigative verdict is indeterminate.

Attack stage
Execution and discovery observed; initiating action undetermined
Model
gpt-5.6-sol · 6 evidence calls

Observed impact

  • Eight root-context dash shell processes were observed in the protected workload.
  • Five root-context env processes classified as discovery were observed as direct children of corresponding shells.
  • The eight correlated shell lifecycles exited with zero status; no additional security impact is established by the bounded evidence.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

8 observations · 8 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

5 observations · 5 process
Process.correlated exit99%

A previously correlated process lifecycle exited

8 observations · 8 process

Explicit uncertainty

  • The bounded process summaries exclude exact command arguments, so the purpose and full behavior of each dash invocation cannot be determined.
  • No HTTP evidence reference is available for these process-only signals; the initiating request or action and actor are unknown.
  • No flow evidence reference is available for these process-only signals; request-to-socket causality and any network consequence cannot be assessed.
  • The stable parent process is identified only by PID in the bounded summaries; its executable, legitimacy, and authorization context are not established.
  • The source key denotes a workload cluster, not a guaranteed human or remote actor identity.
  • Zero exit status proves process completion, not that the activity was benign or that exploitation failed.
  • No evidence establishes persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Validate whether parent PID 2212455 and its repeated dash/env child pattern match the processor workload's approved entrypoint, scheduler, health checks, or administrative automation.
  2. Review deployment manifests, image build history, workload audit records, and operator/change activity around 2026-08-28T02:54Z–02:58Z to determine authorization.
  3. Acquire approved process telemetry containing command arguments and parent executable identity, and correlate it with workload application logs; preserve relevant records before rotation.
  4. If the activity is not expected, isolate or replace the affected workload using established procedures, rotate workload-accessible credentials, and investigate adjacent telemetry for follow-on behavior.
  5. Reduce routine root execution and shell availability in the workload where operationally feasible; use a non-root identity and explicit allowlisted diagnostic mechanisms.