Back to evidence

Sanitized live incident

Reconnaissance

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 30, 6:31:30 PM PDT
Evidence through
Aug 30, 6:38:50 PM PDT
AI status
Complete
True positive98% confidence

Verified HTTP evidence shows non-reflected root identity output and kernel identification returned by the server, despite HTTP 400 responses. Event-driven process telemetry independently observed root-run dash shells and an id child in the correlated workload during those response windows, followed by zero-result lifecycle exits. Together, this establishes real server-side command execution and discovery, not reconnaissance alone. The HTTP-to-process edge remains temporal/workload correlation rather than unique request causality, and no incident-cited flow evidence was available to assess network follow-on activity.

Attack stage
Exploitation: server-side command execution with system and identity discovery
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • Server-side shell and identity-discovery processes executed as root in the affected workload.
  • HTTP responses disclosed root/UID 0 identity information and kernel identification.
  • The exposed service was subjected to broad route and HTTP-method enumeration.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

32 observations · 11 http
Http.server command output85%

Response contains non-reflected process identity output

1 observations · 1 http
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

2 observations · 2 process
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

3 observations · 3 process
Process.correlated exit99%

A previously correlated process lifecycle exited

3 observations · 3 process
Http.server kernel output84%

Response contains non-reflected kernel identification

1 observations · 1 http

Explicit uncertainty

  • The process events are correlated by workload and time; they do not establish a unique HTTP-request-to-process causality edge.
  • The source key denotes a traffic cluster, not a guaranteed person or agent identity; whether this was an authorized security test is unknown.
  • No flow evidence event is cited by this incident, so outbound network activity and request-to-socket consequences cannot be assessed from the available bounded evidence.
  • Exact paths, query strings, headers, and raw bodies are excluded from the bounded summaries, preventing identification of the precise vulnerable parameter and root cause.
  • The available evidence does not establish host escape, persistence, lateral movement, command-and-control, or data theft; their absence from this bounded evidence is not proof they did not occur.

Recommended actions

  1. Immediately preserve relevant application, gateway, and workload telemetry, then isolate or redeploy the affected processor workload according to incident-response policy.
  2. Disable or restrict the implicated API functionality pending root-cause analysis; require authentication and input validation, and patch the command-execution path before restoration.
  3. Reduce workload privilege: run the service as a non-root identity, remove unnecessary capabilities, use a read-only filesystem where feasible, and enforce an egress policy.
  4. Review secrets and credentials accessible to the workload and rotate any that may have been exposed, based on scope and organizational policy.
  5. Search retained telemetry for the same traffic cluster and workload around the incident window, including follow-on processes and outbound flows, and verify whether the activity was an authorized test.