staging-ci-01-critical-1068961348 · Overview

Session

`staging-ci-01-critical-1068961348`

claude-code on staging-ci-01 · 1m28s · first 2026-04-22 17:15:39 · last 2026-04-22 17:17:07

Notes 0

No notes yet. Leave the first one so the next reviewer inherits the context.

Processes 2

File opens 4

DNS / TCP / UDP 6 / 4 / 1

Sensitive hits 2

Event timeline · 17:15:39 → 17:17:07 · peak 3 events/bin

Sensitive path hits · 2 matches

Path	Reason	Op	Process	When
`C:\Users\bill\.aws\config`	aws credentials	open	pid 3490	`2026-04-22T17:17:03.66819715Z`
`C:\Users\bill\.aws\config`	aws credentials	open	pid 3490	`2026-04-22T17:17:03.66819715Z`

Suspicious host queries · 1 match

Host	Reason
`transfer.sh`	anonymous file drop

Registry persistence · 2 hits

Key	Value	Op	Reason	Process	When
`\REGISTRY\USER\S-1-5-21-1000\Software\Microsoft\Windows\CurrentVersion\Run`	`Updater`	set	run key	pid 9004	`2026-04-22T17:17:07.66819715Z`
`\REGISTRY\USER\S-1-5-21-1000\Software\Microsoft\Windows\CurrentVersion\Run`	`Updater`	set	run key	pid 9004	`2026-04-22T17:17:07.66819715Z`

Posted 2026-04-22 22:14:21Z