{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.376875799+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203385420700812 proc_exe_ino_mtime=1794203384969698646 proc_exe_ino_ctime_duration_proc_start=1427955797398 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204813376875799,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":null,"proc.cmdline":"calico","proc.cwd":"","proc.exe":"/opt/cni/bin/calico","proc.exe_ino.ctime":1794203385420700812,"proc.exe_ino.ctime_duration_proc_start":1427955797398,"proc.exe_ino.mtime":1794203384969698646,"proc.exepath":"/opt/cni/bin/calico","proc.name":"calico","proc.pname":"containerd","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:33.376875799Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.455619542+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59482->10.96.0.1:443 lport=443 rport=59482 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0","output_fields":{"evt.time.iso8601":1794204813455619542,"evt.type":"connect","fd.l4proto":"tcp","fd.lport":443,"fd.name":"172.18.0.2:59482->10.96.0.1:443","fd.rport":59482,"fd.type":"ipv4","k8s.ns.name":null,"k8s.pod.name":null,"proc.cmdline":"calico","proc.exepath":"/opt/cni/bin/calico","proc.name":"calico","proc.pname":"containerd","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Notice","rule":"Contact K8S API Server From Container","source":"syscall","tags":["T1565","container","k8s","maturity_stable","mitre_discovery","network"],"time":"2026-11-09T06:13:33.455619542Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.474512249+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico-ipam proc_sname= gparent=containerd proc_exe_ino_ctime=1794203386863707739 proc_exe_ino_mtime=1794203385745702372 proc_exe_ino_ctime_duration_proc_start=1426610531534 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204813474512249,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":"containerd","proc.cmdline":"calico-ipam","proc.cwd":"","proc.exe":"/opt/cni/bin/calico-ipam","proc.exe_ino.ctime":1794203386863707739,"proc.exe_ino.ctime_duration_proc_start":1426610531534,"proc.exe_ino.mtime":1794203385745702372,"proc.exepath":"/opt/cni/bin/calico-ipam","proc.name":"calico-ipam","proc.pname":"calico","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:33.474512249Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.547158939+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59490->10.96.0.1:443 lport=443 rport=59490 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0","output_fields":{"evt.time.iso8601":1794204813547158939,"evt.type":"connect","fd.l4proto":"tcp","fd.lport":443,"fd.name":"172.18.0.2:59490->10.96.0.1:443","fd.rport":59490,"fd.type":"ipv4","k8s.ns.name":null,"k8s.pod.name":null,"proc.cmdline":"calico-ipam","proc.exepath":"/opt/cni/bin/calico-ipam","proc.name":"calico-ipam","proc.pname":"calico","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Notice","rule":"Contact K8S API Server From Container","source":"syscall","tags":["T1565","container","k8s","maturity_stable","mitre_discovery","network"],"time":"2026-11-09T06:13:33.547158939Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.576318825+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/loopback proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203387120708973 proc_exe_ino_mtime=1794203387113708939 proc_exe_ino_ctime_duration_proc_start=1426455199268 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=loopback proc_exepath=/opt/cni/bin/loopback parent=containerd command=loopback terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204813576318825,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":null,"proc.cmdline":"loopback","proc.cwd":"","proc.exe":"/opt/cni/bin/loopback","proc.exe_ino.ctime":1794203387120708973,"proc.exe_ino.ctime_duration_proc_start":1426455199268,"proc.exe_ino.mtime":1794203387113708939,"proc.exepath":"/opt/cni/bin/loopback","proc.name":"loopback","proc.pname":"containerd","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:33.576318825Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.581072468+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/portmap proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203387134709040 proc_exe_ino_mtime=1794203387128709011 proc_exe_ino_ctime_duration_proc_start=1426445994142 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=portmap proc_exepath=/opt/cni/bin/portmap parent=containerd command=portmap terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204813581072468,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":null,"proc.cmdline":"portmap","proc.cwd":"","proc.exe":"/opt/cni/bin/portmap","proc.exe_ino.ctime":1794203387134709040,"proc.exe_ino.ctime_duration_proc_start":1426445994142,"proc.exe_ino.mtime":1794203387128709011,"proc.exepath":"/opt/cni/bin/portmap","proc.name":"portmap","proc.pname":"containerd","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:33.581072468Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.586683425+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203385420700812 proc_exe_ino_mtime=1794203384969698646 proc_exe_ino_ctime_duration_proc_start=1428165601187 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204813586683425,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":null,"proc.cmdline":"calico","proc.cwd":"","proc.exe":"/opt/cni/bin/calico","proc.exe_ino.ctime":1794203385420700812,"proc.exe_ino.ctime_duration_proc_start":1428165601187,"proc.exe_ino.mtime":1794203384969698646,"proc.exepath":"/opt/cni/bin/calico","proc.name":"calico","proc.pname":"containerd","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:33.586683425Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.669210806+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59496->10.96.0.1:443 lport=443 rport=59496 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0","output_fields":{"evt.time.iso8601":1794204813669210806,"evt.type":"connect","fd.l4proto":"tcp","fd.lport":443,"fd.name":"172.18.0.2:59496->10.96.0.1:443","fd.rport":59496,"fd.type":"ipv4","k8s.ns.name":null,"k8s.pod.name":null,"proc.cmdline":"calico","proc.exepath":"/opt/cni/bin/calico","proc.name":"calico","proc.pname":"containerd","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Notice","rule":"Contact K8S API Server From Container","source":"syscall","tags":["T1565","container","k8s","maturity_stable","mitre_discovery","network"],"time":"2026-11-09T06:13:33.669210806Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.687313749+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico-ipam proc_sname= gparent=containerd proc_exe_ino_ctime=1794203386863707739 proc_exe_ino_mtime=1794203385745702372 proc_exe_ino_ctime_duration_proc_start=1426823338214 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204813687313749,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":"containerd","proc.cmdline":"calico-ipam","proc.cwd":"","proc.exe":"/opt/cni/bin/calico-ipam","proc.exe_ino.ctime":1794203386863707739,"proc.exe_ino.ctime_duration_proc_start":1426823338214,"proc.exe_ino.mtime":1794203385745702372,"proc.exepath":"/opt/cni/bin/calico-ipam","proc.name":"calico-ipam","proc.pname":"calico","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:33.687313749Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:33.798485463+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59512->10.96.0.1:443 lport=443 rport=59512 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0","output_fields":{"evt.time.iso8601":1794204813798485463,"evt.type":"connect","fd.l4proto":"tcp","fd.lport":443,"fd.name":"172.18.0.2:59512->10.96.0.1:443","fd.rport":59512,"fd.type":"ipv4","k8s.ns.name":null,"k8s.pod.name":null,"proc.cmdline":"calico-ipam","proc.exepath":"/opt/cni/bin/calico-ipam","proc.name":"calico-ipam","proc.pname":"calico","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Notice","rule":"Contact K8S API Server From Container","source":"syscall","tags":["T1565","container","k8s","maturity_stable","mitre_discovery","network"],"time":"2026-11-09T06:13:33.798485463Z"}