{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:25.007142564+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname= gparent= proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1370271683527 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent= command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203423779498188,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204805007142564,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.aname[2]":null,"proc.cmdline":"ps aux","proc.cwd":"/","proc.exe":"ps","proc.exe_ino.ctime":1794203434720940389,"proc.exe_ino.ctime_duration_proc_start":1370271683527,"proc.exe_ino.mtime":1753876720000000000,"proc.exepath":"/usr/bin/ps","proc.name":"ps","proc.pname":null,"proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:25.007142564Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:25.007142564+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent= container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204805007142564,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps","proc.pname":null,"user.name":"root"},"priority":"Notice","rule":"Custom T1057 Process Discovery","source":"syscall","tags":["T1057","custom","mitre"],"time":"2026-11-09T06:13:25.007142564Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:25.007142564+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)","output_fields":{"evt.time.iso8601":1794204805007142564,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"ps aux","proc.name":"ps"},"priority":"Warning","rule":"PR10 Response Trigger PB1 Process Discovery","source":"syscall","tags":["T1057","mitre","pb1","pr10_response"],"time":"2026-11-09T06:13:25.007142564Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:25.112810705+0000: Notice Unexpected connection to K8s API Server from container | connection=192.168.0.144:55824->10.96.0.1:443 lport=55824 rport=443 fd_type=ipv4 fd_proto=tcp evt_type=connect user= user_uid=1234 user_loginuid=-1 process=falco-talon proc_exepath=/ko-app/falco-talon parent=containerd-shim command=falco-talon server -c /etc/falco-talon/config.yaml -r /etc/falco-talon/rules.yaml terminal=0","output_fields":{"evt.time.iso8601":1794204805112810705,"evt.type":"connect","fd.l4proto":"tcp","fd.lport":55824,"fd.name":"192.168.0.144:55824->10.96.0.1:443","fd.rport":443,"fd.type":"ipv4","k8s.ns.name":"falco","k8s.pod.name":"falco-talon-7488868c58-wm5l2","proc.cmdline":"falco-talon server -c /etc/falco-talon/config.yaml -r /etc/falco-talon/rules.yaml","proc.exepath":"/ko-app/falco-talon","proc.name":"falco-talon","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"","user.uid":1234},"priority":"Notice","rule":"Contact K8S API Server From Container","source":"syscall","tags":["T1565","container","k8s","maturity_stable","mitre_discovery","network"],"time":"2026-11-09T06:13:25.112810705Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:25.451935878+0000: Notice Unexpected connection to K8s API Server from container | connection=192.168.0.144:55840->10.96.0.1:443 lport=55840 rport=443 fd_type=ipv4 fd_proto=tcp evt_type=connect user= user_uid=1234 user_loginuid=-1 process=falco-talon proc_exepath=/ko-app/falco-talon parent=containerd-shim command=falco-talon server -c /etc/falco-talon/config.yaml -r /etc/falco-talon/rules.yaml terminal=0","output_fields":{"evt.time.iso8601":1794204805451935878,"evt.type":"connect","fd.l4proto":"tcp","fd.lport":55840,"fd.name":"192.168.0.144:55840->10.96.0.1:443","fd.rport":443,"fd.type":"ipv4","k8s.ns.name":"falco","k8s.pod.name":"falco-talon-7488868c58-wm5l2","proc.cmdline":"falco-talon server -c /etc/falco-talon/config.yaml -r /etc/falco-talon/rules.yaml","proc.exepath":"/ko-app/falco-talon","proc.name":"falco-talon","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"","user.uid":1234},"priority":"Notice","rule":"Contact K8S API Server From Container","source":"syscall","tags":["T1565","container","k8s","maturity_stable","mitre_discovery","network"],"time":"2026-11-09T06:13:25.451935878Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:25.503013381+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh /tmp/talon-script.sh process=sh parent= container=cible1 pod=cible1 namespace=default)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204805503013381,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/talon-script.sh","proc.name":"sh","proc.pname":null,"user.name":"root","user.uid":0},"priority":"Warning","rule":"Shell Script Executed From Writable Container Path","source":"syscall","tags":["caldera","container","mitre","script_execution"],"time":"2026-11-09T06:13:25.503013381Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:25.503013381+0000: Warning CUSTOM T1059.004 - Shell non interactif (user=root command=sh /tmp/talon-script.sh parent= container=cible1 pod=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204805503013381,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/talon-script.sh","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1059.004 Non Interactive Shell","source":"syscall","tags":["T1059.004","custom","mitre"],"time":"2026-11-09T06:13:25.503013381Z"} {"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:25.503013381+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh /tmp/talon-script.sh parent= container=cible1)","output_fields":{"container.name":"cible1","evt.time.iso8601":1794204805503013381,"fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1","proc.cmdline":"sh /tmp/talon-script.sh","proc.name":"sh","proc.pname":null,"user.name":"root"},"priority":"Warning","rule":"Custom T1082 Enumeration Script","source":"syscall","tags":["T1082","custom","mitre"],"time":"2026-11-09T06:13:25.503013381Z"}