Back to evidence

Sanitized live incident

Attempted exploitation

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 30, 9:58:01 AM PDT
Evidence through
Aug 30, 11:09:33 AM PDT
AI status
Complete
Likely true positive93% confidence

Likely true positive command-injection exploitation with workload-level execution. Multiple HTTP requests were classified as containing shell metacharacters and command tokens, and root-context dash processes appeared tens of milliseconds later in the correlated processor workload. The strongest examples include dash spawning the discovery utilities id and uname as direct children. This repeated request/exec pattern strongly supports successful command execution, although routing affinity and temporal correlation do not provide a unique per-request causality edge. No cited flow evidence was available, so outbound communication, command-and-control, and exfiltration are not established.

Attack stage
Command injection leading to execution and discovery in the workload
Model
gpt-5.6-sol · 13 evidence calls

Observed impact

  • Root-context shell execution and child discovery utilities were observed in the correlated processor workload.
  • Outbound-capable shell processes were observed, but no cited network flow proves that they established an outbound connection.
  • The cited shell and discovery processes were short-lived; the available evidence does not establish persistence, host escape, lateral movement, or data theft.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

4923 observations · 12 http
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

17 observations · 12 http
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

20 observations · 12 process
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

11 observations · 11 process
Process.correlated network client80%

An outbound-capable client process appeared in the correlated workload and request window

6 observations · 6 process
Process.correlated exit99%

A previously correlated process lifecycle exited

22 observations · 12 process

Explicit uncertainty

  • There is no observed per-request trace or parentage edge from an HTTP request to a process; causality is inferred from repeated same-workload temporal correlation.
  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Authorization is unknown. The evidence cannot exclude an approved security test or an intentionally exposed command-execution function, although the repeated injection and process pattern is strongly suspicious.
  • No flow-plane event is cited by this incident; a flow-evidence query therefore could not establish outbound connections, destination novelty, command-and-control, or exfiltration.
  • HTTP summaries exclude raw paths, query strings, headers, and bodies, and the bounded summaries do not expose server-generated command output.

Recommended actions

  1. If this activity is not an approved test, isolate or replace the affected processor workload and preserve its process, application, gateway, and orchestration telemetry for forensic review.
  2. Review the API handler represented by the cited path hash for unsafe shell invocation. Remove shell interpolation, use fixed argument arrays or safe library calls, and strictly validate untrusted parameters.
  3. Determine which authenticated principal, token, or session generated the requests; revoke or rotate affected credentials if unauthorized use is confirmed.
  4. Rebuild or redeploy the workload from a trusted image and verify filesystem and configuration integrity before restoring service if compromise is suspected.
  5. Run the service as a non-root identity with a read-only filesystem and minimal Linux capabilities, and restrict execution of shells and discovery/network utilities where operationally feasible.
  6. Review retained network telemetry around the cited process times and apply least-privilege egress controls; do not infer command-and-control solely from the network-client process classification.
  7. Confirm whether the source cluster and activity window correspond to an authorized scanner or test, then tune detections only if authorization and expected behavior are verified.