{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:56.190517139+0000: Critical Executing binary not part of base image | proc_exe=mount proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1598799138907 proc_cwd=./ container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=mount proc_exepath=/usr/bin/mount parent=<NA> command=mount -t tmpfs -o size=8195915776,noswap tmpfs /var/lib/kubelet/pods/d42c65e5-c468-4816-8f47-429406851698/volumes/kubernetes.io~projected/kube-api-access-cfx4d terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204836190517139,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":null,"proc.cmdline":"mount -t tmpfs -o size=8195915776,noswap tmpfs /var/lib/kubelet/pods/d42c65e5-c468-4816-8f47-429406851698/volumes/kubernetes.io~projected/kube-api-access-cfx4d","proc.cwd":"./","proc.exe":"mount","proc.exe_ino.ctime":1794203237390967569,"proc.exe_ino.ctime_duration_proc_start":1598799138907,"proc.exe_ino.mtime":1785512076000000000,"proc.exepath":"/usr/bin/mount","proc.name":"mount","proc.pname":null,"proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:56.190517139Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:56.338136276+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203385420700812 proc_exe_ino_mtime=1794203384969698646 proc_exe_ino_ctime_duration_proc_start=1450917097190 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204836338136276,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":null,"proc.cmdline":"calico","proc.cwd":"","proc.exe":"/opt/cni/bin/calico","proc.exe_ino.ctime":1794203385420700812,"proc.exe_ino.ctime_duration_proc_start":1450917097190,"proc.exe_ino.mtime":1794203384969698646,"proc.exepath":"/opt/cni/bin/calico","proc.name":"calico","proc.pname":"containerd","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:56.338136276Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:56.338135853+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/loopback proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203387120708973 proc_exe_ino_mtime=1794203387113708939 proc_exe_ino_ctime_duration_proc_start=1449217068544 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=loopback proc_exepath=/opt/cni/bin/loopback parent=containerd command=loopback terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204836338135853,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":null,"proc.cmdline":"loopback","proc.cwd":"","proc.exe":"/opt/cni/bin/loopback","proc.exe_ino.ctime":1794203387120708973,"proc.exe_ino.ctime_duration_proc_start":1449217068544,"proc.exe_ino.mtime":1794203387113708939,"proc.exepath":"/opt/cni/bin/loopback","proc.name":"loopback","proc.pname":"containerd","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:56.338135853Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:56.431810086+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59416->10.96.0.1:443 lport=443 rport=59416 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0","output_fields":{"evt.time.iso8601":1794204836431810086,"evt.type":"connect","fd.l4proto":"tcp","fd.lport":443,"fd.name":"172.18.0.2:59416->10.96.0.1:443","fd.rport":59416,"fd.type":"ipv4","k8s.ns.name":null,"k8s.pod.name":null,"proc.cmdline":"calico","proc.exepath":"/opt/cni/bin/calico","proc.name":"calico","proc.pname":"containerd","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Notice","rule":"Contact K8S API Server From Container","source":"syscall","tags":["T1565","container","k8s","maturity_stable","mitre_discovery","network"],"time":"2026-11-09T06:13:56.431810086Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:56.461322619+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico-ipam proc_sname= gparent=containerd proc_exe_ino_ctime=1794203386863707739 proc_exe_ino_mtime=1794203385745702372 proc_exe_ino_ctime_duration_proc_start=1449597309706 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204836461322619,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":"containerd","proc.cmdline":"calico-ipam","proc.cwd":"","proc.exe":"/opt/cni/bin/calico-ipam","proc.exe_ino.ctime":1794203386863707739,"proc.exe_ino.ctime_duration_proc_start":1449597309706,"proc.exe_ino.mtime":1794203385745702372,"proc.exepath":"/opt/cni/bin/calico-ipam","proc.name":"calico-ipam","proc.pname":"calico","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:56.461322619Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:56.550851790+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59428->10.96.0.1:443 lport=443 rport=59428 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0","output_fields":{"evt.time.iso8601":1794204836550851790,"evt.type":"connect","fd.l4proto":"tcp","fd.lport":443,"fd.name":"172.18.0.2:59428->10.96.0.1:443","fd.rport":59428,"fd.type":"ipv4","k8s.ns.name":null,"k8s.pod.name":null,"proc.cmdline":"calico-ipam","proc.exepath":"/opt/cni/bin/calico-ipam","proc.name":"calico-ipam","proc.pname":"calico","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Notice","rule":"Contact K8S API Server From Container","source":"syscall","tags":["T1565","container","k8s","maturity_stable","mitre_discovery","network"],"time":"2026-11-09T06:13:56.550851790Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:56.652250538+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/portmap proc_sname= gparent=<NA> proc_exe_ino_ctime=1794203387134709040 proc_exe_ino_mtime=1794203387128709011 proc_exe_ino_ctime_duration_proc_start=1449517088711 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=portmap proc_exepath=/opt/cni/bin/portmap parent=containerd command=portmap terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794203237024714316,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204836652250538,"evt.type":"execve","fd.name":null,"k8s.ns.name":null,"k8s.pod.name":null,"proc.aname[2]":null,"proc.cmdline":"portmap","proc.cwd":"","proc.exe":"/opt/cni/bin/portmap","proc.exe_ino.ctime":1794203387134709040,"proc.exe_ino.ctime_duration_proc_start":1449517088711,"proc.exe_ino.mtime":1794203387128709011,"proc.exepath":"/opt/cni/bin/portmap","proc.name":"portmap","proc.pname":"containerd","proc.sname":"","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:56.652250538Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:57.150359132+0000: Critical Executing binary not part of base image | proc_exe=mount proc_sname=runc:[1:CHILD] gparent=runc:[1:CHILD] proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1599758981149 proc_cwd=/run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/ container_start_ts=1794204836957360535 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=mount proc_exepath=/usr/bin/mount parent=mount-product-f command=mount -o ro,bind /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/product_name /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/sys/class/dmi/id/product_name terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794204836957360535,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204837150359132,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1-replacement-99b589dcc-cq7bd","proc.aname[2]":"runc:[1:CHILD]","proc.cmdline":"mount -o ro,bind /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/product_name /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/sys/class/dmi/id/product_name","proc.cwd":"/run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/","proc.exe":"mount","proc.exe_ino.ctime":1794203237390967569,"proc.exe_ino.ctime_duration_proc_start":1599758981149,"proc.exe_ino.mtime":1785512076000000000,"proc.exepath":"/usr/bin/mount","proc.name":"mount","proc.pname":"mount-product-f","proc.sname":"runc:[1:CHILD]","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:57.150359132Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:57.154657979+0000: Critical Executing binary not part of base image | proc_exe=mount proc_sname=runc:[1:CHILD] gparent=runc:[1:CHILD] proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1599763168700 proc_cwd=/run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/ container_start_ts=1794204836957360535 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=mount proc_exepath=/usr/bin/mount parent=mount-product-f command=mount -o ro,bind /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/product_uuid /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/sys/class/dmi/id/product_uuid terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794204836957360535,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204837154657979,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1-replacement-99b589dcc-cq7bd","proc.aname[2]":"runc:[1:CHILD]","proc.cmdline":"mount -o ro,bind /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/product_uuid /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/sys/class/dmi/id/product_uuid","proc.cwd":"/run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/","proc.exe":"mount","proc.exe_ino.ctime":1794203237390967569,"proc.exe_ino.ctime_duration_proc_start":1599763168700,"proc.exe_ino.mtime":1785512076000000000,"proc.exepath":"/usr/bin/mount","proc.name":"mount","proc.pname":"mount-product-f","proc.sname":"runc:[1:CHILD]","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:57.154657979Z"}
{"hostname":"secu-lab-control-plane","output":"2026-11-09T06:13:57.159098896+0000: Critical Executing binary not part of base image | proc_exe=mount proc_sname=runc:[1:CHILD] gparent=runc:[1:CHILD] proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1599767613313 proc_cwd=/run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/ container_start_ts=1794204836957360535 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=mount proc_exepath=/usr/bin/mount parent=mount-product-f command=mount -o ro,bind /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/product_uuid /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/sys/devices/virtual/dmi/id/product_uuid terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER","output_fields":{"container.start_ts":1794204836957360535,"evt.arg.flags":"EXE_WRITABLE|EXE_UPPER_LAYER","evt.time.iso8601":1794204837159098896,"evt.type":"execve","fd.name":null,"k8s.ns.name":"default","k8s.pod.name":"cible1-replacement-99b589dcc-cq7bd","proc.aname[2]":"runc:[1:CHILD]","proc.cmdline":"mount -o ro,bind /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/product_uuid /run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/sys/devices/virtual/dmi/id/product_uuid","proc.cwd":"/run/containerd/io.containerd.runtime.v2.task/k8s.io/a2acae825b304d08ed9a9d11634e5497b54c2fb72421d4294b82b467f19fd277/rootfs/","proc.exe":"mount","proc.exe_ino.ctime":1794203237390967569,"proc.exe_ino.ctime_duration_proc_start":1599767613313,"proc.exe_ino.mtime":1785512076000000000,"proc.exepath":"/usr/bin/mount","proc.name":"mount","proc.pname":"mount-product-f","proc.sname":"runc:[1:CHILD]","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0},"priority":"Critical","rule":"Drop and execute new binary in container","source":"syscall","tags":["PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"],"time":"2026-11-09T06:13:57.159098896Z"}