Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 28, 12:00:55 PM PDT
Evidence through
Aug 28, 12:13:33 PM PDT
AI status
Complete
Indeterminate78% confidence

The detector's critical suspicious-activity output is supported at the process-observation level: event-driven root `dash` executions occurred repeatedly, one was classified as both a shell and network client, and later root processes executed/accessed inventory-resolved shared resource [redacted] (process evidence [redacted], [redacted], [redacted], [redacted], [redacted], [redacted]; inventory evidence [redacted]). However, the bounded evidence exposes neither command arguments/content nor a causal originating action. No incident-cited HTTP or flow event was available to establish exploitation or an outbound connection. The same observations could reflect unauthorized execution or legitimate processor/administrative behavior, so compromise cannot be adjudicated from the available evidence.

Attack stage
Execution observed; origin and maliciousness undetermined
Model
gpt-5.6-sol · 15 evidence calls

Observed impact

  • Root shell processes executed inside the protected processor workload ([redacted], [redacted], [redacted], [redacted]).
  • A root `dash` process was classified as an outbound-capable network client, but no network connection is proven ([redacted]).
  • Execution from and access to shared resource [redacted] were observed, including root `cat` access ([redacted], [redacted], [redacted], 6af9849212cfffd2
  • A sampled shell lifecycle exited nonzero; other sampled shell lifecycles exited zero ([redacted], [redacted], [redacted]).

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

21 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

23 observations · 12 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

1 observations · 1 process
Process.shared resource activity92%

A process executed or interpreted content from an inventory-resolved resource attached to multiple workloads

4 observations · 4 process · 1 inventory

Explicit uncertainty

  • No incident-cited HTTP event was available through the bounded HTTP evidence interface, so no request, remote source, or request-to-process causality can be assessed.
  • No incident-cited flow event was available through the bounded flow evidence interface, so the network-client classification cannot be tied to a destination or an actual connection.
  • The secret-free process summaries omit exact arguments/content, preventing determination of what the shells executed or what `cat` read.
  • The initiating parent action and actor are unknown. The source key denotes a workload cluster, not a guaranteed human or agent identity.
  • Expected behavior and deployment context for the processor workload and shared resource are unavailable; shell/script execution may be legitimate workload or administrative activity.
  • The evidence does not establish whether shared resource contents were modified, trusted, or malicious, nor whether other attached workloads executed the same content.

Recommended actions

  1. Validate the observed parent process and recurring root-shell pattern against the processor's expected job, health-check, deployment, and administrative workflows.
  2. Preserve relevant process, orchestration, application, authentication, and audit telemetry for [redacted]–[redacted] UTC before rotation.
  3. Review the integrity, provenance, permissions, and recent change history of shared resource [redacted], and identify every workload to which it is attached.
  4. Correlate PID/parent lineage with application job IDs or orchestrator audit events to identify the initiating action without assuming HTTP causality.
  5. Review network telemetry around [redacted] UTC for the workload to determine whether the network-client-class process opened any connection and whether the destination was authorized.
  6. If the behavior is not immediately attributable to an approved workflow, isolate or restrict the affected workload proportionally, rotate credentials accessible to it, and redeploy from a known-good image after evidence preservation.
  7. Reduce workload privileges where feasible: avoid root execution, constrain shell availability, use read-only mounts, and limit egress and shared-resource access to required paths and destinations.