Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 27, 8:55:08 PM PDT
Evidence through
Aug 27, 9:20:53 PM PDT
AI status
Complete
Likely true positive91% confidence

Likely true positive for unauthorized or otherwise security-relevant workload execution, but not proof of an HTTP exploit. Event-driven telemetry shows root-context shell and discovery execution, an outbound-capable process class, a root shell/child command targeting a sensitive file, and mutation plus access of an inventory-resolved shared resource in the same processor workload [redacted]. This combination is substantially more suspicious than a shell spawn alone. However, no cited HTTP or flow event was available to establish an originating request, remote actor, or actual outbound connection, and the bounded evidence does not establish persistence, lateral movement, host escape, command-and-control, or exfiltration.

Attack stage
Workload execution with discovery, collection targeting, and shared-resource modification
Model
gpt-5.6-sol · 11 evidence calls

Observed impact

  • Root-context shell and discovery processes executed within the processor workload.
  • A root shell and child cat process targeted a sensitive file; the evidence does not reveal the target contents or prove disclosure.
  • An inventory-resolved shared resource was mutated and then accessed from the workload, creating potential impact beyond the initiating process.
  • An outbound-capable shell process was spawned, but no actual network connection is established by the cited evidence.
  • At least one observed shell lifecycle exited successfully; this does not establish that all suspicious activity ended.

Deterministic signals

Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

102 observations · 12 process
Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

769 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

802 observations · 12 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

1 observations · 1 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

2 observations · 2 process
Process.shared resource activity92%

A process modified an inventory-resolved resource attached to multiple workloads

2 observations · 2 process · 1 inventory

Explicit uncertainty

  • No cited HTTP evidence was available, so the originating action, request, actor, and any request-to-process causality remain unknown.
  • No cited flow evidence was available. The network-client process classification does not prove that a connection occurred or identify a destination.
  • The source key represents a workload or traffic cluster, not a guaranteed human or remote-agent identity.
  • The bounded process summaries exclude exact arguments and paths, so the precise sensitive file, commands, data viewed, and material changes cannot be determined here.
  • The evidence does not distinguish malicious activity from an approved administrative, diagnostic, test, or workload automation sequence; owner validation is required.
  • Shared-resource attribution does not by itself prove persistence, execution in another workload, or downstream damage.
  • No cited evidence proves host escape, lateral movement, command-and-control, credential theft, or data exfiltration.

Recommended actions

  1. Promptly ask the workload owner whether this shell/discovery, sensitive-file access, network-client spawn, and shared-resource mutation sequence was expected and tied to an approved deployment or administrative task.
  2. If the activity is unapproved, contain the affected processor workload and replace it from a known-good image while preserving process, orchestrator, audit, and storage-change evidence.
  3. Review the parent process represented by PPID 2212455 and relevant orchestrator/job/audit records to identify the initiating workload action without assuming an HTTP origin.
  4. Inspect and compare the affected shared resource against a known-good version; determine which other workloads mount it and assess them for resulting changes or execution.
  5. Determine which sensitive file was targeted. If it held credentials or tokens and unauthorized access is plausible, rotate affected secrets and review their subsequent use.
  6. Review independent network telemetry around 2026-08-28T04[redacted].901544982Z for actual connections from the workload before drawing conclusions about egress or exfiltration.
  7. Reduce exposure by running the processor as non-root where feasible, removing unnecessary shells and discovery utilities, restricting egress, and limiting write access to shared resources.