Sigtrace AI.Trace · Forensic session report

Session `staging-ci-01-critical-59535636`

Agent claude-code on host staging-ci-01 · 1m28s

Session ID: staging-ci-01-critical-59535636
Agent: claude-code
Host: staging-ci-01
First seen: 2026-04-20 23:44:16Z
Last seen: 2026-04-20 23:45:44Z
Duration: 1m28s
Events captured: 35
Posted at: 2026-04-22 22:14:21Z
Report generated: 2026-04-23 10:34:57Z
Report ID: 5e2a7f566bcdc019
Schema version: 1
Live dashboard: https://demo.sigtrace.ai/ui/sessions/staging-ci-01-critical-59535636

Verdict Critical 2 sensitive paths 1 suspicious host 2 registry hits 1 shell spawn 4 network targets

Sensitive path hits · 2

Path	Reason	Op	Process	Pid	When
`C:\Users\bill\.kube\config`	kube config	open		8158	`2026-04-20T23:45:40.591538552Z`
`C:\Users\bill\.kube\config`	kube config	open		8158	`2026-04-20T23:45:40.591538552Z`

Host	Reason
`anonfiles.com`	anonymous file drop

No suspicious command lines.

Key	Value	Op	Reason	Process	Pid	When
`\REGISTRY\USER\S-1-5-21-1000\Software\Microsoft\Windows\CurrentVersion\Run`	`Updater`	set	run key		9099	`2026-04-20T23:45:44.591538552Z`
`\REGISTRY\USER\S-1-5-21-1000\Software\Microsoft\Windows\CurrentVersion\Run`	`Updater`	set	run key		9099	`2026-04-20T23:45:44.591538552Z`

No flagged image loads.

Image	Count
`C:\Users\bill\AppData\Roaming\Claude\claude-code\2.1.111\claude.exe`	1
`C:\Windows\System32\cmd.exe`	1

Path	Count
`C:\work\pipeline\tests\test_ingest.py`	5
`C:\work\pipeline\pipeline\stages\ingest.py`	3
`C:\work\pipeline\pipeline\stages\transform.py`	3
`C:\work\pipeline\pyproject.toml`	3

Path	Count
`C:\work\pipeline\Makefile`	1

No renames or deletes.

Target	Count
`45.137.21.9:53413`	2