Back to evidence

Sanitized live incident

Opportunistic scan

Native source identity and targetable endpoints are private.

mediumopen
Confidence
96%
First seen
Aug 24, 10:30:46 PM PDT
Evidence through
Aug 24, 10:31:19 PM PDT
AI status
Complete
True positive98% confidence

The incident is a true positive for opportunistic reconnaissance/web-shell path enumeration, not for confirmed compromise. The cited HTTP series records a rapid burst against PHP/WordPress probe-path categories, and the detector-derived aggregate reports 41 requests across 20 unique probe paths. Available outcomes are redirects or rejections, including 301 and 404 responses. HTTP status alone cannot prove exploit failure, but the available evidence contains no demonstrated execution or other downstream consequence. Process and flow evidence could not be retrieved because this incident cites no events from those planes.

Attack stage
Reconnaissance: opportunistic PHP/WordPress web-shell path enumeration
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • A brief burst of 41 HTTP probes reached the target and produced only redirect/rejection outcomes in the cited evidence.
  • No command execution, outbound connection, persistence, lateral movement, or data access is established by the available evidence.

Deterministic signals

Http.php webshell enumeration96%

Rapid enumeration of PHP and WordPress web-shell paths

298 observations · 12 http

Explicit uncertainty

  • The incident cites no process-plane or flow-plane event IDs. Queries to those evidence tools therefore could not retrieve telemetry, so execution and egress consequences cannot be independently assessed from those planes.
  • HTTP response bodies are represented only by bounded metadata and hashes; their content is not available for inspection. Nonempty 404 bodies cannot be assumed to be command output or ordinary error pages.
  • The source key denotes a traffic/workload cluster and may represent a proxy, NAT gateway, multiple workers, or another aggregation rather than one actor.
  • Target workload affinity is inferred from configured routing and is not an observed per-request trace edge.

Recommended actions

  1. Continue monitoring the source cluster and target for repeated probes or a transition from path enumeration to payload-bearing requests; apply rate limiting or blocking according to policy and recurrence.
  2. Review application, reverse-proxy, and workload logs for the 2026-08-25T05[redacted]46Z–[redacted]52Z window to confirm whether any requests reached an application handler and whether any unusual child processes occurred.
  3. Verify that the probed PHP/WordPress paths and known web-shell filenames are absent from deployed content, and remove or restrict unnecessary PHP/WordPress components.
  4. Correlate retained workload process and outbound-network telemetry around the incident window because those planes were not cited in this incident.
  5. Keep the incident scoped as reconnaissance unless additional evidence demonstrates execution, persistence, outbound communication, or data access.