Sanitized live incident
Suspicious activity
Native source identity and targetable endpoints are private.
criticalopen
- Confidence
- 99%
- First seen
- Sep 30, 8:20:21 PM PDT
- Evidence through
- Sep 30, 8:30:32 PM PDT
- AI status
- Pending
AI investigation is Pending
Deterministic signals remain live while the bounded assessment completes.
Observed impact
- Correlated process exited
- Shell spawned
- Workload root shell
Deterministic signals
An event-driven shell execution was observed in a protected workload without correlated HTTP evidence
154 observations · 12 processA previously correlated process lifecycle exited
154 observations · 12 process