Back to evidence

Sanitized live incident

Attempted exploitation

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 26, 8:25:01 PM PDT
Evidence through
Aug 26, 9:35:33 PM PDT
AI status
Complete
True positive97% confidence

Observed exploitation progressed beyond probing to server-side command execution. A captured HTTP response contained non-reflected process-identity output identifying uid 0/root, which is execution evidence despite the HTTP 400 status [redacted]. Independently, event-driven process telemetry recorded a root-run `id` process in the correlated workload shortly afterward [redacted]. A later request contained shell metacharacters and command tokens [redacted], followed closely by a root-run `dash` process in that workload [redacted]. The HTTP-to-process relationships remain temporal/workload correlations rather than unique causal trace edges, but the non-reflected server output directly supports successful execution.

Attack stage
Execution via suspected HTTP command injection, preceded by surface enumeration
Model
gpt-5.6-sol · 8 evidence calls

Observed impact

  • Server-side process identity was disclosed as uid 0/root in an HTTP response [redacted].
  • A root-run discovery command (`id`) executed in the correlated processor workload [redacted].
  • A root-run shell (`dash`) executed and then exited successfully in the correlated workload [redacted].
  • No cited evidence establishes persistence, host escape, lateral movement, command-and-control, or data theft.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

2637 observations · 12 http
Http.server command output85%

Response contains non-reflected process identity output

1 observations · 1 http
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

2 observations · 2 process
Process.correlated exit99%

A previously correlated process lifecycle exited

2 observations · 2 process
Http.command injection attempt88%

Request contains shell metacharacters and command tokens

1 observations · 1 http
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

1 observations · 1 process

Explicit uncertainty

  • The source key is a traffic cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • Authorization is unknown; broad automated probing can also occur during sanctioned testing, although the observed execution still makes the technical detection valid.
  • Configured target routing and time proximity do not provide a unique HTTP request-to-process causality edge.
  • No flow-plane event was cited by this incident, so outbound network consequences and request-to-socket relationships cannot be assessed.
  • The bounded evidence does not establish persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Immediately isolate or restrict the affected processor workload while preserving volatile and forensic evidence.
  2. Rotate credentials, tokens, and secrets accessible to the workload, prioritizing any material available to uid 0 inside its security boundary.
  3. Review and remediate the API input path associated with the command-injection detections; enforce strict allow-list validation and avoid invoking shells with request-derived data.
  4. Rebuild or redeploy the workload from a trusted image after collecting evidence, and verify that its runtime is not unnecessarily configured to run as root.
  5. Review surrounding gateway, application, process, and network telemetry for additional commands, file changes, credential access, or outbound activity.
  6. Determine whether the source cluster was associated with an authorized security test; do not let authorization review delay containment of confirmed execution behavior.