2026-11-09T06:10:50Z INF init category=kubernetes status=success 2026-11-09T06:10:50Z INF init result="15 rule(s) has/have been successfully loaded" 2026-11-09T06:10:50Z INF init result="watch of rules enabled" 2026-11-09T06:10:50Z INF http result="Falco Talon is up and listening on 0.0.0.0:2803" 2026-11-09T06:10:50Z INF nats result="new leader detected '192.168.0.138'" 2026-11-09T06:11:02Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:11:02.894182363+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico proc_sname= gparent= proc_exe_ino_ctime=1794203385420700812 proc_exe_ino_mtime=1794203384969698646 proc_exe_ino_ctime_duration_proc_start=1277473091986 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=750da2edfbffab826fee9d45c6a97198 2026-11-09T06:11:02Z INF event event="Contact K8S API Server From Container" output="2026-11-09T06:11:02.980697136+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59722->10.96.0.1:443 lport=443 rport=59722 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico proc_exepath=/opt/cni/bin/calico parent=containerd command=calico terminal=0" priority=Notice source=syscall trace_id=f589ec32182fe19152355118a5017b4e 2026-11-09T06:11:03Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:11:03.057438362+0000: Critical Executing binary not part of base image | proc_exe=/opt/cni/bin/calico-ipam proc_sname= gparent=containerd proc_exe_ino_ctime=1794203386863707739 proc_exe_ino_mtime=1794203385745702372 proc_exe_ino_ctime_duration_proc_start=1276193384350 proc_cwd= container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=486fb3198aa441a638c19008603d2ac0 2026-11-09T06:11:03Z INF event event="Contact K8S API Server From Container" output="2026-11-09T06:11:03.231436630+0000: Notice Unexpected connection to K8s API Server from container | connection=172.18.0.2:59736->10.96.0.1:443 lport=443 rport=59736 fd_type=ipv4 fd_proto=tcp evt_type=connect user=root user_uid=0 user_loginuid=-1 process=calico-ipam proc_exepath=/opt/cni/bin/calico-ipam parent=calico command=calico-ipam terminal=0" priority=Notice source=syscall trace_id=1ac984edf7c502a2b892e022d8a021c1 2026-11-09T06:11:03Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:11:03.467948741+0000: Critical Executing binary not part of base image | proc_exe=umount proc_sname= gparent= proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1426076593404 proc_cwd=./ container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=umount proc_exepath=/usr/bin/umount parent= command=umount /var/lib/kubelet/pods/5b402589-da07-4749-b1b5-f030a77d3621/volumes/kubernetes.io~secret/config terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=86950b0dd74e512001f068ce7be60f9d 2026-11-09T06:11:03Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:11:03.456177606+0000: Critical Executing binary not part of base image | proc_exe=umount proc_sname= gparent= proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1426064861894 proc_cwd=./ container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=umount proc_exepath=/usr/bin/umount parent= command=umount /var/lib/kubelet/pods/5b402589-da07-4749-b1b5-f030a77d3621/volume-subpaths/rules/falco-talon/1 terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=9201645cb4117dabf6be612c2f35da52 2026-11-09T06:11:04Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:11:03.453804705+0000: Critical Executing binary not part of base image | proc_exe=umount proc_sname= gparent= proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1426062420316 proc_cwd=./ container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=umount proc_exepath=/usr/bin/umount parent= command=umount /var/lib/kubelet/pods/5b402589-da07-4749-b1b5-f030a77d3621/volumes/kubernetes.io~projected/kube-api-access-v78x4 terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=cff5c797b05783e9af6386e7ee366c85 2026-11-09T06:11:04Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:11:03.454265837+0000: Critical Executing binary not part of base image | proc_exe=umount proc_sname= gparent= proc_exe_ino_ctime=1794203237390967569 proc_exe_ino_mtime=1785512076000000000 proc_exe_ino_ctime_duration_proc_start=1426062934945 proc_cwd=./ container_start_ts=1794203237024714316 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=umount proc_exepath=/usr/bin/umount parent= command=umount /var/lib/kubelet/pods/5b402589-da07-4749-b1b5-f030a77d3621/volume-subpaths/config/falco-talon/0 terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=82c2b4ca42afb9b6d89d34b2d145ea1c