Sanitized live incident
Suspicious activity
Native source identity and targetable endpoints are private.
criticalopen
- Confidence
- 99%
- First seen
- Sep 21, 8:00:36 PM PDT
- Evidence through
- Sep 21, 8:03:17 PM PDT
- AI status
- Pending
AI investigation is Pending
Deterministic signals remain live while the bounded assessment completes.
Observed impact
- Correlated process exited
- Shell spawned
- Workload root shell
Deterministic signals
An event-driven shell execution was observed in a protected workload without correlated HTTP evidence
117 observations · 12 processA previously correlated process lifecycle exited
117 observations · 12 process