Back to evidence

Sanitized live incident

Suspicious activity

Native source identity and targetable endpoints are private.

criticalopen
Confidence
99%
First seen
Aug 26, 12:19:28 PM PDT
Evidence through
Aug 26, 1:28:03 PM PDT
AI status
Complete
Likely true positive82% confidence

Likely unauthorized in-workload execution: event-driven telemetry shows a root dash process spawning root `id`, followed minutes later by a separate root dash/cat chain targeting a sensitive file and another root dash classified as a network client. These behaviors are directly observed in process evidence ([redacted], [redacted], [redacted], [redacted], [redacted]). The initial dash and `id` processes exited with zero outcomes ([redacted], [redacted]). However, authorization and origin cannot be established because the incident cites no retrievable HTTP or flow event, so exploitation, sensitive-data acquisition, and successful outbound communication remain unproven.

Attack stage
Execution and discovery; possible collection and outbound tooling
Model
gpt-5.6-sol · 12 evidence calls

Observed impact

  • Root shell and discovery processes executed inside the protected workload.
  • A root cat process targeting a sensitive file was spawned; successful content access is not established.
  • A root shell classified as an outbound-capable network client was spawned; no connection is established by cited flow evidence.

Deterministic signals

Process.observed shell spawn99%

An event-driven shell execution was observed in a protected workload without correlated HTTP evidence

108 observations · 12 process
Process.observed discovery command88%

An event-driven discovery command was observed in a protected workload without correlated HTTP evidence

6 observations · 6 process
Process.correlated exit99%

A previously correlated process lifecycle exited

110 observations · 12 process
Process.observed sensitive file command99%

An event-driven process targeted a sensitive file in a protected workload without correlated HTTP evidence

2 observations · 2 process
Process.observed network client87%

An event-driven outbound-capable client was observed in a protected workload without correlated HTTP evidence

3 observations · 3 process

Explicit uncertainty

  • The originating action, actor, and authorization status are unknown; the source key is a workload cluster rather than a person or remote-agent identity.
  • No HTTP evidence event is cited for retrieval, so no request-to-process causality or web exploitation path can be established.
  • No flow evidence event is cited for retrieval, so the network-client process does not prove that any outbound connection occurred.
  • The bounded summaries omit exact arguments and the sensitive target identity; they do not prove that file contents were successfully read, retained, or exfiltrated.
  • The identity and expected behavior of parent PID 2212046 are not available, leaving legitimate workload automation or administrative activity as an alternative explanation.
  • No cited evidence proves persistence, host escape, lateral movement, command-and-control, or data theft.

Recommended actions

  1. Promptly validate parent PID 2212046 and the associated workload deployment, job, or administrative automation against expected behavior and change records.
  2. If the activity is not immediately authorized, isolate or replace the affected workload using normal response procedures while preserving process and orchestration telemetry.
  3. Review workload audit, application, and orchestration logs around 19:19–19:29Z to identify the initiating action and recover command context unavailable in the bounded summaries.
  4. Review file-access telemetry for the sensitive target and egress telemetry around 19:24Z; do not infer exposure solely from process creation.
  5. Assess secrets accessible to the workload and rotate affected credentials if file-access or disclosure evidence indicates likely exposure.
  6. Harden the workload by removing unnecessary shells/network clients, running as non-root where feasible, and constraining filesystem and egress permissions.