Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 20, 1:26:15 PM PDT
Evidence through
Aug 20, 1:56:07 PM PDT
AI status
Complete
Likely true positive86% confidence

Likely true positive for suspicious post-start execution inside the processor workload, but not proof of an external exploit or actor identity. Verified telemetry shows repeated event-driven, root-context dash execution, a shell classified as targeting a sensitive file, execution/access/mutation involving the same shared resource, and outbound-capable shell processes [redacted]. This combination is materially suspicious, although the evidence cannot determine whether it was authorized processor behavior. No incident-cited HTTP or flow event was available to establish an initiating request or an actual network connection.

Attack stage
Execution with sensitive-file targeting, shared-resource modification, and potential outbound activity
Model
gpt-5.6-sol · 13 evidence calls

Observed impact

  • Root-context shell execution occurred inside the protected processor workload.
  • A root-context shell command was classified as targeting a sensitive file; the specific access outcome is not established.
  • Processes executed, accessed, and mutated the same shared resource, creating potential integrity impact; the resulting content change and dependent-workload effects are unknown.
  • Outbound-capable shell processes were spawned, but no actual connection, command-and-control, or exfiltration was established.
  • At least one observed shell lifecycle exited successfully; this proves process completion, not request causality or overall attack success.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

107 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

173 observations · 12 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

1 observations · 1 process
Process.shared resource activity92%

A process executed or interpreted content from an inventory-resolved resource attached to multiple workloads

142 observations · 11 process · 1 inventory
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

9 observations · 9 process

Explicit uncertainty

  • No incident-cited HTTP event was available to retrieve, so the originating request or action and any request-to-process causality remain unknown.
  • No incident-cited flow event was available to retrieve, so the network-client processes cannot be tied to an actual socket, destination, command-and-control channel, or data transfer.
  • The source key is a workload cluster and does not identify a human or remote actor.
  • The bounded process summaries omit exact arguments and sensitive target details, preventing determination of the precise commands, file, intended purpose, and resulting content.
  • Authorization context is unavailable. The same long-lived parent spawning many short-lived shells could reflect processor or administrative automation, although the sensitive-target, shared-resource mutation, and network-client combination is suspicious.
  • The evidence does not establish host escape, persistence, lateral movement, credential theft, command-and-control, or data exfiltration.
  • The shared-resource operations do not establish the resulting content state or whether other attached workloads executed modified content.

Recommended actions

  1. Validate the workload's expected behavior and identify the owner and purpose of parent PID 3528249; compare the observed shell, sensitive-file, shared-resource, and network-client activity with approved jobs or deployment automation.
  2. If the activity is not immediately attributable to authorized operations, contain the affected workload and temporarily restrict its egress while preserving process, filesystem, orchestration, and network telemetry.
  3. Integrity-check shared resource [redacted] against a trusted version, determine which workloads mount it, and inspect those workloads for execution of changed content.
  4. Review filesystem audit data for the sensitive target and shared resource to determine whether reads or writes succeeded and what changed.
  5. Review available DNS, proxy, firewall, and conntrack retention around 2026-08-20T20[redacted]53Z to determine whether the outbound-capable processes established connections or transferred data.
  6. Preserve the workload image and relevant logs. Rotate credentials or secrets accessible to the workload if review confirms unauthorized sensitive-file access or compromise.
  7. Reduce exposure by running the processor as a non-root identity where feasible and limiting shell availability, writable shared mounts, and egress to required destinations.