Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 26, 11:25:01 AM PDT
Evidence through
Aug 26, 1:40:11 PM PDT
AI status
Complete
Likely true positive88% confidence

The process evidence supports genuine, sustained high-risk execution behavior inside one protected workload: root-context dash shells spawned discovery children, including an exact shell-to-id parent/child sequence (process evidence [redacted] and [redacted]); a root dash shell spawned cat against a telemetry-classified sensitive target ([redacted] and [redacted]); and root dash executions were classified as outbound-capable network clients ([redacted], [redacted], and [redacted]). This is likely a true positive for unauthorized or otherwise suspicious workload execution, discovery, and possible credential/configuration access. The verdict stops short of confirmed compromise because authorization and initiating action are unknown, and no cited HTTP or flow evidence was available to establish initial access, request-to-process causality, a resulting socket, command-and-control, or exfiltration.

Attack stage
Execution and discovery; possible sensitive-data access, with initial access and exfiltration unproven
Model
gpt-5.6-sol · 13 evidence calls

Observed impact

  • Observed root-context shell and discovery-process execution in the protected workload (process evidence [redacted], [redacted], [redacted]).
  • Observed a root-context cat process against a telemetry-classified sensitive target (process evidence [redacted]); successful content acquisition is not proven.
  • Observed outbound-capable shell-class process executions (process evidence [redacted], [redacted], [redacted]); no resulting network connection is proven.
  • At least two cited shell processes exited with zero outcomes, bounding those individual lifecycles but not resolving the wider recurring activity (process evidence [redacted], [redacted]).

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

8436 observations · 12 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

920 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

8759 observations · 12 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

245 observations · 12 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

3 observations · 3 process

Explicit uncertainty

  • No HTTP evidence references were cited by this process-only incident, so the HTTP evidence tool could not provide a verified request summary. The initiating action, initial-access vector, and any request-to-process relationship remain unknown.
  • No flow evidence references were cited by this incident, so the flow evidence tool could not verify a resulting connection or destination. Command-and-control and exfiltration are not established.
  • The source key is a workload/traffic cluster, not a proven human or remote actor identity.
  • The available evidence does not establish whether this processor workload was intentionally designed or administratively authorized to launch shells, perform discovery, inspect sensitive files, or invoke outbound-capable clients.
  • The sensitive-file summary does not expose the file path or prove that content was read, retained, or transferred.
  • No evidence proves host escape, persistence, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Promptly confirm with the workload owner whether the observed shell, discovery, sensitive-file, and network-client behavior is expected for this processor deployment. Treat the activity as unauthorized until validated.
  2. If the behavior is not immediately explained, contain or pause the affected workload using normal operational procedures while preserving process, orchestrator, and application telemetry.
  3. Investigate the repeatedly observed parent process corresponding to PPID 2212455: map it to its container entrypoint, image, deployment revision, service account, and recent configuration or job changes.
  4. Review retained workload and egress telemetry around 2026-08-26T18[redacted]01Z through [redacted]40Z for uncited HTTP initiators, message-queue/job triggers, socket events, DNS activity, and destination context; do not infer causality from timing alone.
  5. Identify the telemetry-classified sensitive targets accessed by cat and assess whether credentials, tokens, keys, or configuration were exposed. Rotate affected secrets if exposure cannot be excluded.
  6. Compare the deployed image and filesystem against a trusted build, and review admission, exec, CI/CD, and administrative audit logs for the initiating principal or automation.
  7. Reduce blast radius by running the processor as a non-root user where feasible, limiting shell/tool availability, restricting sensitive-file permissions, and enforcing least-privilege egress policy.