Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 25, 12:37:39 PM PDT
Evidence through
Aug 25, 12:38:11 PM PDT
AI status
Complete
Indeterminate88% confidence

Verified process telemetry establishes two event-driven root executions of the dash shell in the same workload, both from the same observed parent PID. Exact lifecycle evidence shows each process later exited successfully. This confirms shell execution but does not establish malicious exploitation: the incident cites no HTTP or flow event that can be inspected, and the bounded summaries do not expose command arguments, parent executable identity, or an initiating actor. The detector's critical suspicious-activity output is therefore supported as an execution anomaly, while compromise remains indeterminate.

Attack stage
Execution — root shell processes observed; initiating action unknown
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • Two dash shell processes executed as root in the protected workload.
  • Both observed shell processes exited with a zero outcome; no further consequence is established by cited evidence.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

2 observations · 2 process
Process.correlated exit99%

A previously correlated process lifecycle exited

2 observations · 2 process

Explicit uncertainty

  • No HTTP evidence reference is cited by this incident, so request content, exploit delivery, response output, and request-to-process causality cannot be assessed.
  • No flow evidence reference is cited by this incident, so network consequences and request-to-socket causality cannot be assessed.
  • The bounded process summaries do not expose command arguments or the parent executable identity, preventing determination of whether dash was invoked by legitimate workload logic, administration, or malicious activity.
  • The source key is a workload cluster rather than a proven human or remote actor identity.
  • Zero exit outcomes show that the processes exited successfully, not that their purpose was benign or malicious.
  • No cited evidence establishes persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Preserve the workload and surrounding process telemetry, then retrieve the full parent/ancestor lineage and command-line context for parent PID 2212455 through authorized operational channels.
  2. Compare these shell invocations with the processor workload's deployment manifest, entrypoint, scheduled jobs, and expected child-process baseline.
  3. Review workload-local application and audit logs around 2026-08-25T19[redacted]39Z through [redacted]12Z for the internal action that initiated the shells.
  4. If the shell executions are not expected, isolate or replace the workload according to established response procedures and investigate credential or configuration exposure.
  5. Add or validate HTTP and egress-flow telemetry coverage for this workload so future shell events can be causally investigated.