Back to evidence

Sanitized live incident

Confirmed compromise

Native source identity and targetable endpoints are private.

criticalconfirmed
Confidence
99%
First seen
Aug 28, 7:28:08 PM PDT
Evidence through
Aug 28, 7:32:54 PM PDT
AI status
Complete
True positive99% confidence

Confirmed remote command injection with successful root-level execution in the responding application workload. Non-reflected process-identity and kernel output in HTTP responses proves execution even though the responses were HTTP 400. Event-driven process telemetry independently shows root-run dash shells spawning id, uname, and hostname in matching windows. A public-web outbound flow was also observed from an inventory-attributed media-edge workload, but it is not causally linked to the requests or processor command execution. The detector's immutable state is confirmed and is consistent with the evidence.

Attack stage
Exploitation: command injection leading to workload execution and system discovery
Model
gpt-5.6-sol · 11 evidence calls

Observed impact

  • Confirmed arbitrary command execution as root within the responding application workload.
  • System identity and kernel information were disclosed through HTTP responses.
  • Multiple root-run shell and discovery processes executed; the cited lifecycles subsequently exited successfully.
  • A baseline-novel outbound public-web flow occurred elsewhere in the target environment, but its relationship to exploitation is unproven.

Deterministic signals

Http.command injection attempt88%

Request contains shell metacharacters and command tokens

5 observations · 5 http
Flow.correlated new outbound destination70%

The correlated workload opened a flow to a destination not previously observed in the captured baseline

1 observations · 1 flow · 1 inventory
Http.server command output85%

Response contains non-reflected process identity output

1 observations · 1 http
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

6 observations · 6 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

6 observations · 6 process
Process.correlated exit99%

A previously correlated process lifecycle exited

9 observations · 9 process
Http.server kernel output97%

Response contains non-reflected kernel identification

1 observations · 1 http

Explicit uncertainty

  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, multiple workers, or more than one human or agent.
  • Configured routing supplies downstream workload affinity; there is no observed per-request trace edge to a specific workload instance.
  • Process correlation uses workload identity and time proximity. No unique HTTP-request-to-process parentage edge is available.
  • The outbound flow is attributed to a media-edge workload, whereas the root shell/discovery telemetry is associated with the processor workload; no evidence proves they are part of the same causal chain.
  • Conntrack does not identify the initiating request or process, and destination novelty is relative only to the retained baseline.
  • Evidence proves compromise of the responding application workload, not host escape, persistence, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Immediately isolate or replace the affected processor workload while preserving relevant container/runtime, application, HTTP, and process evidence for forensic review.
  2. Disable or restrict the vulnerable API route until the command-injection flaw is fixed; use strict allow-list validation and avoid invoking a shell with request-derived data.
  3. Remove root execution from the service, enforce a non-root runtime identity, minimize Linux capabilities, use a read-only filesystem where feasible, and apply egress controls.
  4. Review secrets, tokens, service-account credentials, and mounted configuration accessible to the compromised workload; rotate any credentials that may have been exposed.
  5. Investigate the media-edge outbound flow separately using retained network and workload telemetry; do not assume it was exploit-driven without a process/socket linkage.
  6. Hunt for additional shell/discovery execution, modified files, unexpected child processes, and persistence indicators across sibling workloads and the underlying node.