2026-11-09T06:12:46Z INF event event="Custom T1082 Enumeration Script" output="2026-11-09T06:12:46.819286728+0000: Warning CUSTOM T1082 - Exécution d’un script d’énumération (user=root command=sh /tmp/manual-shell.sh parent=sh container=cible1)" priority=Warning source=syscall trace_id=dabc9d217f9a729742f9661c375537ba
2026-11-09T06:12:46Z INF event event="Shell Script Executed From Writable Container Path" output="2026-11-09T06:12:46.819286728+0000: Warning Exécution suspecte d’un script shell dans un conteneur (user=root uid=0 command=sh /tmp/manual-shell.sh process=sh parent=sh container=cible1 pod=cible1 namespace=default)" priority=Warning source=syscall trace_id=28473d559cf7e6edb29e5d1d73cab45f
2026-11-09T06:12:46Z INF event event="PR10 Route S14 PB3" output="2026-11-09T06:12:46.806584234+0000: Warning PR10 ROUTE S14 PB3 (pod=cible1 namespace=default scenario=S14 commande=sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh)" priority=Warning source=syscall trace_id=4806d7a192c08d1e4bd967a04436aa5d
2026-11-09T06:12:46Z INF event event="Drop and execute new binary in container" output="2026-11-09T06:12:46.832800126+0000: Critical Executing binary not part of base image | proc_exe=ps proc_sname=sh gparent=sh proc_exe_ino_ctime=1794203434720940389 proc_exe_ino_mtime=1753876720000000000 proc_exe_ino_ctime_duration_proc_start=1332111303754 proc_cwd=/ container_start_ts=1794203423779498188 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ps proc_exepath=/usr/bin/ps parent=sh command=ps aux terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER" priority=Critical source=syscall trace_id=927bbe7c0dc1c87c20f06cec0caac127
2026-11-09T06:12:46Z INF event event="PR10 Response Trigger PB1 Process Discovery" output="2026-11-09T06:12:46.832800126+0000: Warning PR10 RESPONSE PB1 (pod=cible1 namespace=default processus=ps commande=ps aux)" priority=Warning source=syscall trace_id=993cc157bd468a7c0a85bfa76dd0a789
2026-11-09T06:12:46Z INF event event="Custom T1057 Process Discovery" output="2026-11-09T06:12:46.832800126+0000: Notice CUSTOM T1057 - Découverte des processus (user=root command=ps aux parent=sh container=cible1)" priority=Notice source=syscall trace_id=97b72dfc2cf4e77932dbda893d3bf954
2026-11-09T06:12:46Z INF match event="PR10 Route S14 PB3" output="2026-11-09T06:12:46.806584234+0000: Warning PR10 ROUTE S14 PB3 (pod=cible1 namespace=default scenario=S14 commande=sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh)" priority=Warning rule="PB3 Routing Validation Playbook S14" source=syscall trace_id=4806d7a192c08d1e4bd967a04436aa5d
2026-11-09T06:12:46Z INF action action="S14 PB3 Routing Marker" actionner=kubernetes:label event="2026-11-09T06:12:46.806584234+0000: Warning PR10 ROUTE S14 PB3 (pod=cible1 namespace=default scenario=S14 commande=sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh)" rule="PB3 Routing Validation Playbook S14" status=in_progress trace_id=4806d7a192c08d1e4bd967a04436aa5d
2026-11-09T06:12:46Z INF action action="S14 PB3 Routing Marker" actionner=kubernetes:label event="2026-11-09T06:12:46.806584234+0000: Warning PR10 ROUTE S14 PB3 (pod=cible1 namespace=default scenario=S14 commande=sh -c PR10_SCENARIO=S14; printf '%s\\n' '#!/bin/sh' 'id' 'uname -a' 'ps aux | head -10' 'ls -la /tmp | head -20' > /tmp/manual-shell.sh; chmod +x /tmp/manual-shell.sh; /bin/sh /tmp/manual-shell.sh; rm -f /tmp/manual-shell.sh)" namespace=default output="the pod 'cible1' in the namespace 'default' has been labeled" pod=cible1 rule="PB3 Routing Validation Playbook S14" status=success trace_id=4806d7a192c08d1e4bd967a04436aa5d
2026-11-09T06:12:46Z INF notification action="S14 PB3 Routing Marker" actionner=kubernetes:label notifier=k8sevents rule="PB3 Routing Validation Playbook S14" stage=action status=success trace_id=4806d7a192c08d1e4bd967a04436aa5d