Back to evidence

Sanitized live incident

Attempted exploitation

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 26, 10:58:56 AM PDT
Evidence through
Aug 26, 12:24:02 PM PDT
AI status
Complete
Likely true positive94% confidence

Likely successful command-injection exploitation, not merely scanning. A captured GET containing shell metacharacters and command tokens was followed 69 ms later in the correlated workload by a root-run dash process classified as shell/discovery/network-client; that process exited nonzero [redacted]. Later, another captured injection-pattern GET was followed 35 ms later by a root dash execution that exited zero [redacted]. A separate observed root dash spawned root uname, and both exited zero [redacted]. This strongly supports workload-level command execution and discovery, but correlation is by workload and time rather than a unique request trace; authorization and network consequences remain unverified.

Attack stage
Exploitation with workload command execution and system discovery
Model
gpt-5.6-sol · 13 evidence calls

Observed impact

  • Root-context shell execution was observed in the correlated workload [redacted].
  • Root-context system discovery via uname was observed as a child of dash [redacted].
  • The cited shell and discovery lifecycles were short-lived and exited, including zero exits for a dash/uname chain; this does not establish persistence [process [redacted], [redacted], 7404f0d3c9da

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

9986 observations · 12 http
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

1354 observations · 12 http
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

102 observations · 12 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

575 observations · 12 process
Process.correlated network client80%

An outbound-capable client process appeared in the correlated workload and request window

1 observations · 1 process
Process.correlated exit99%

A previously correlated process lifecycle exited

606 observations · 12 process

Explicit uncertainty

  • No unique per-request trace or parentage edge proves that any particular HTTP request created a particular process; workload identity and temporal proximity provide the correlation.
  • The bounded HTTP summaries do not expose raw payloads or response content, so the exact injected commands and whether responses contained command output are unknown.
  • No incident-cited flow event was available to get_flow_evidence. Actual outbound connections, destinations, transfer volume, and request-to-socket causality are therefore unverified; the network-client process classification alone does not establish network activity.
  • The source key is a traffic cluster, not a guaranteed person or agent identity, and authorization for the enumeration or injection traffic is not established.
  • No cited evidence establishes persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Treat the processor workload as potentially compromised: preserve process, application, and gateway telemetry, then isolate or replace the workload according to operational risk and incident-response policy.
  2. Prioritize review and remediation of the affected API handler for unsafe command construction. Remove shell invocation where possible, apply strict allow-list validation, and add regression tests for metacharacter injection.
  3. Identify the parent process represented by PPID 2212455 and review application logs around [redacted]–[redacted] to establish the request-to-process path and the exact commands executed.
  4. Review workload-accessible credentials, tokens, mounted secrets, and service-account permissions; rotate those credibly exposed by root-context execution.
  5. Search retained workload and node telemetry for additional shells, discovery utilities, file modifications, persistence mechanisms, and child processes outside the cited short-lived lifecycles.
  6. Review egress telemetry for the workload during and after the incident window. If no verified flow records exist, preserve available network logs before retention expires.
  7. Determine whether the source traffic cluster corresponds to an authorized scanner or test system; do not use the cluster key alone as a human identity. Apply temporary rate limiting or access controls if the activity is unauthorized.