{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:09:37.062115544+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c cat /etc/shadow >/dev/null parent=<NA> container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204577062115544,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c cat /etc/shadow >/dev/null","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:09:37.062115544Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:09:37.069036229+0000: Warning Sensitive file opened for reading by non-trusted program | file=/etc/shadow gparent=<NA> ggparent=<NA> gggparent=<NA> evt_type=openat user=root user_uid=0 user_loginuid=-1 process=cat proc_exepath=/usr/bin/cat parent=sh command=cat /etc/shadow terminal=0","output_fields":{"evt.time.iso8601":1794204577069036229,"evt.type":"openat","fd.name":"/etc/shadow","k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.aname[3]":null,"proc.aname[4]":null,"proc.cmdline":"cat /etc/shadow","proc.exepath":"/usr/bin/cat","proc.name":"cat","proc.pname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2026-11-09T06:09:37.069036229Z"}