Back to evidence

Sanitized live incident

Attempted exploitation

Native source identity and targetable endpoints are private.

highopen
Confidence
99%
First seen
Aug 28, 2:16:38 AM PDT
Evidence through
Aug 28, 2:39:37 AM PDT
AI status
Complete
Likely true positive98% confidence

Repeated command-injection HTTP activity was followed within the correlated windows by event-driven root shell, discovery, sensitive-target, and shared-resource process activity. The strongest sequences are: a suspicious PUT targeting the system account database followed about 2.4 seconds later by root dash and env execution [redacted], and later suspicious GETs followed within hundreds of milliseconds by root shell mutation/execution of the same shared resource and, in the final sequence, a parent-linked dash→dash→cat sensitive-target chain [redacted]. This strongly supports successful workload-level command execution, but request-to-process causality remains inferential rather than a unique trace edge. No flow-plane event was available, so no network consequence is assessed.

Attack stage
Exploitation with workload command execution, discovery, sensitive-file targeting, and shared-resource modification/execution
Model
gpt-5.6-sol · 18 evidence calls

Observed impact

  • Root shell and discovery processes were observed in two correlated workload keys [redacted].
  • A root sensitive-file tool execution was observed in the final parent-linked shell chain [redacted].
  • Mutation and execution of shared resource [redacted] were observed from correlated root processes [redacted].
  • No host escape, persistence, external connectivity, command-and-control, or data theft is established by the available evidence.

Deterministic signals

Http.command injection attempt88%

Request contains shell metacharacters and command tokens

8 observations · 8 http
Process.correlated sensitive file command80%

A process command targeted a sensitive file in the correlated workload and request window

2 observations · 2 process
Process.correlated shell spawn80%

A shell process appeared in the correlated workload and request window

16 observations · 12 process
Process.correlated discovery command80%

A discovery process appeared in the correlated workload and request window

14 observations · 12 process
Process.correlated exit99%

A previously correlated process lifecycle exited

21 observations · 12 process
Process.shared resource activity80%

A process modified an inventory-resolved resource attached to multiple workloads

10 observations · 10 process · 1 inventory

Explicit uncertainty

  • HTTP summaries exclude exact paths, query strings, headers, and bodies, so the precise injected command text and any returned command output are unavailable.
  • Workload affinity is inferred from configured routing, and the available telemetry does not establish a unique causal edge from any individual HTTP request to a process tree.
  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, or multiple workers rather than one actor.
  • No flow-plane event is cited by this incident; outbound connectivity, destination novelty, command-and-control, and exfiltration therefore cannot be assessed.
  • The bounded evidence does not establish whether the activity was an authorized security test or unapproved exploitation.
  • The sensitive-target classification proves a targeting command/tool was executed, but does not by itself prove what data was successfully read or disclosed.
  • Shared-resource mutation and execution are observed, but the exact changed content and whether it persisted beyond these process lifecycles are unavailable.

Recommended actions

  1. Immediately isolate or remove the two affected workload instances from serving traffic while preserving process, application, and storage evidence.
  2. Snapshot and integrity-check shared resource [redacted]; compare it with a known-good version, replace it if altered, and prevent untrusted workloads from both writing and executing it.
  3. Patch the command-injection path, enforce strict input validation and structured argument passing, and eliminate shell invocation for request-derived data.
  4. Rebuild affected workloads from trusted images and run them as non-root with read-only filesystems, least-privilege mounts, and restricted execution on shared storage.
  5. Review access to the system account database and rotate any credentials or secrets that could have been exposed; scope this action according to validated file-access findings.
  6. Correlate application logs, request identifiers, orchestration events, and full process lineage to establish the missing per-request causal edge and determine whether the activity was authorized.
  7. Review separate network/egress telemetry for the incident interval because no flow-plane evidence is present in this incident.