{"hostname":"97ade2b595f0","output":"2024-05-07T18:54:19.341081180+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=9656db3bb358 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-07T18:54:19.341081180Z", "output_fields": {"container.id":"9656db3bb358","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715108059341081180,"evt.type":"openat","fd.name":"/etc/shadow","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"97ade2b595f0","output":"2024-05-07T18:54:20.008519431+0000: Informational System user ran an interactive command (evt_type=execve user=daemon user_uid=2 user_loginuid=-1 process=login proc_exepath=/bin/busybox parent=event-generator command=login terminal=0 exe_flags=0 container_id=9656db3bb358 container_name=elastic-package-service-falco-event-generator-1)","priority":"Informational","rule":"System user interactive","source":"syscall","tags":["NIST_800-53_AC-2","T1059","container","host","maturity_stable","mitre_execution","users"],"time":"2024-05-07T18:54:20.008519431Z", "output_fields": {"container.id":"9656db3bb358","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715108060008519431,"evt.type":"execve","proc.cmdline":"login","proc.exepath":"/bin/busybox","proc.name":"login","proc.pname":"event-generator","proc.tty":0,"user.loginuid":-1,"user.name":"daemon","user.uid":2}}
{"hostname":"97ade2b595f0","output":"2024-05-07T18:54:26.271403849+0000: Warning Sensitive file opened for reading by trusted program after startup (file=/etc/shadow pcmdline=event-generator run --loop gparent=containerd-shim ggparent=runc gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=httpd proc_exepath=/bin/event-generator parent=event-generator command=httpd --loglevel info run ^syscall.ReadSensitiveFileUntrusted$ --sleep 6s terminal=0 container_id=9656db3bb358 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file trusted after startup","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-07T18:54:26.271403849Z", "output_fields": {"container.id":"9656db3bb358","container.full_id":"9656db3bb3588e7b23da7d48fe889434573036c27ae5a74837233de441c3601e","container.name":"elastic-package-service-falco-event-generator-1","container.image": "falcosecurity/event-generator:0.10.0","container.image.tag":"0.10.0","container.image.digest":["sha256:d977378f890d445c15e51795296e4e5062f109ce6da83e0a355fc4ad8699d27"],"container.image.id":"16e0fa09a4f1018f22be6cce3ec21848dccaa566b063bda4c814c37dc36adfea","container.image.repository":"falcosecurity/event-generator","evt.time.iso8601":1715108066271403849,"evt.type":"openat","fd.name":"/etc/shadow","proc.cmdline":"httpd --loglevel info run ^syscall.ReadSensitiveFileUntrusted$ --sleep 6s","proc.exepath":"/bin/event-generator","proc.name":"httpd","proc.pcmdline":"event-generator run --loop","proc.pname":"event-generator","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"97ade2b595f0","output":"2024-05-07T18:54:27.767673017+0000: Notice Shell spawned by untrusted binary (parent_exe=/tmp/falco-event-generator3982217557/httpd parent_exepath=/bin/event-generator pcmdline=httpd --loglevel info run ^helper.RunShell$ gparent=event-generator ggparent=containerd-shim aname[4]=runc aname[5]=init aname[6]=init aname[7]=<NA> evt_type=execve user=root user_uid=0 user_loginuid=-1 process=bash proc_exepath=/bin/bash parent=httpd command=bash -c ls > /dev/null terminal=0 exe_flags=EXE_WRITABLE container_id=9656db3bb358 container_name=elastic-package-service-falco-event-generator-1)","priority":"Notice","rule":"Run shell untrusted","source":"syscall","tags":["T1059.004","container","host","maturity_stable","mitre_execution","process","shell"],"time":"2024-05-07T18:54:27.767673017Z", "output_fields": {"container.id":"9656db3bb358","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715108067767673017,"evt.type":"execve","proc.cmdline":"bash -c ls > /dev/null","proc.exepath":"/bin/bash","proc.name":"bash","proc.pcmdline":"httpd --loglevel info run ^helper.RunShell$","proc.pexe":"/tmp/falco-event-generator3982217557/httpd","proc.pexepath":"/bin/event-generator","proc.pname":"httpd","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"97ade2b595f0","output":"2024-05-07T18:54:20.008519431+0000: Informational System user ran an interactive command (evt_type=execve user=daemon user_uid=2 user_loginuid=-1 process=login proc_exepath=/bin/busybox parent=event-generator command=login terminal=0 exe_flags=0 container_id=9656db3bb358 container_name=elastic-package-service-falco-event-generator-1)","priority":"Informational","rule":"System user interactive","source":"syscall","tags":[],"time":"2024-05-07T18:54:20.008519431Z", "output_fields": {"container.id":"9656db3bb358","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715108060008519431,"evt.type":"execve","proc.cmdline":"login","proc.exepath":"/bin/busybox","proc.name":"login","proc.pname":"event-generator","proc.tty":0,"user.loginuid":-1,"user.name":"daemon","user.uid":2}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:26.104747558+0000: Informational System user ran an interactive command (evt_type=execve user=daemon user_uid=2 user_loginuid=-1 process=login proc_exepath=/bin/busybox parent=event-generator command=login terminal=0 exe_flags=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Informational","rule":"System user interactive","source":"syscall","tags":["NIST_800-53_AC-2","T1059","container","host","maturity_stable","mitre_execution","users"],"time":"2024-05-13T13:23:26.104747558Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.arg.flags":"0","evt.time.iso8601":1715606606104747558,"evt.type":"execve","proc.cmdline":"login","proc.exepath":"/bin/busybox","proc.name":"login","proc.pname":"event-generator","proc.tty":0,"user.loginuid":-1,"user.name":"daemon","user.uid":2}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:27.021777225+0000: Notice Shell spawned by untrusted binary (parent_exe=/tmp/falco-event-generator2286495765/httpd parent_exepath=/bin/event-generator pcmdline=httpd --loglevel info run ^helper.RunShell$ gparent=event-generator ggparent=containerd-shim aname[4]=runc aname[5]=init aname[6]=init aname[7]=<NA> evt_type=execve user=root user_uid=0 user_loginuid=-1 process=bash proc_exepath=/bin/bash parent=httpd command=bash -c ls > /dev/null terminal=0 exe_flags=EXE_WRITABLE container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Notice","rule":"Run shell untrusted","source":"syscall","tags":["T1059.004","container","host","maturity_stable","mitre_execution","process","shell"],"time":"2024-05-13T13:23:27.021777225Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.arg.flags":"EXE_WRITABLE","evt.time.iso8601":1715606607021777225,"evt.type":"execve","proc.aname[2]":"event-generator","proc.aname[3]":"containerd-shim","proc.aname[4]":"runc","proc.aname[5]":"init","proc.aname[6]":"init","proc.aname[7]":null,"proc.cmdline":"bash -c ls > /dev/null","proc.exepath":"/bin/bash","proc.name":"bash","proc.pcmdline":"httpd --loglevel info run ^helper.RunShell$","proc.pexe":"/tmp/falco-event-generator2286495765/httpd","proc.pexepath":"/bin/event-generator","proc.pname":"httpd","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:28.170686725+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:28.170686725Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715606608170686725,"evt.type":"openat","fd.name":"/etc/shadow","proc.aname[2]":"runc","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:29.089890892+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:29.089890892Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715606609089890892,"evt.type":"openat","fd.name":"/etc/shadow","proc.aname[2]":"runc","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:29.089890892+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:29.089890892Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715606609089890892,"evt.type":"openat","evt.res": "SUCCESS","fd.name":"/etc/shadow","proc.aname[2]":"runc","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:29.089890892+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:29.089890892Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715606609089890892,"evt.type":"openat","evt.res": "ENOENT","evt.failed":true,"fd.name":"/etc/shadow","proc.aname[2]":"runc","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:31.089890892+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:31.089890892Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715606609089890892,"evt.num":4525,"evt.type":"openat","evt.res": "ENOENT","evt.failed":true,"fd.name":"/etc/shadow","k8s.ns.name":"kubernetes-ns","k8s.pod.ip":"175.16.199.0/24","k8s.pod.name":"kubernetes-pod-1","k8s.pod.uid":"aadadjh763wiuh","k8s.pod.labels":["key1:value1","key2:value2","key3:value3"],"proc.aname[2]":"runc","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:33.089890892+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:33.089890892Z", "output_fields": {"container.id":"84c0b936c919","container.mounts":"/proc/sys/fs/binfmt_misc:/tmp/binary:bind:ro:private /var/log:/mnt/log:bind:rw:shared","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715606609089890892,"evt.type":"openat","evt.res": "ENOENT","evt.failed":true,"fd.name":"/etc/shadow","proc.aname[2]":"runc","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:34.089890892+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:34.089890892Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","container.type":"docker","container.privileged":true,"container.ip":"81.2.69.144","evt.time.iso8601":1715606609089890892,"evt.type":"openat","evt.res": "ENOENT","fd.cip.name":"example.com","fd.sip.name":"otherexample.com","fd.rip.name":"fourthexample.com","fd.lip.name":"thirdexample.com","evt.failed":true,"fd.name":"/etc/shadow","proc.aname[2]":"runc","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:36.089890892+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:36.089890892Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715606609089890892,"evt.type":"openat","evt.res": "ENOENT","evt.failed":true,"fd.name":"/etc/shadow","fd.directory":"var/log/example","fd.filename":"example.tar.gz","fd.cip":"216.160.83.56","fd.sip":"89.160.20.112","fd.lip":"89.160.20.128","fd.rip":"67.43.156.0","fd.cport":5400,"fd.sport":5700,"fd.lport":5689,"fd.rport":6789,"fd.ino":"567874","proc.aname[2]":"runc","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:37.089890892+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Critical","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:37.089890892Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715606609089890892,"evt.type":"openat","evt.res": "ENOENT","evt.failed":true,"fd.name":"/etc/shadow","proc.aname[2]":"runc","group.gid":"123355","group.name":"test-1","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdnargs": 1,"proc.env":"TEST_VALUE1=testvalue1 TEST_VALUE2=testvalue2","proc.cwd":"/bin/event-generator","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.args":"run --loop","proc.name":"event-generator","proc.pid":133567,"proc.ppid":133568,"proc.vpgid":4555852,"proc.vpgid.name":"generic-process","proc.vpgid.exepath":"/bin/event-generator","proc.ppid.duration":2345,"proc.ppid.ts":"23455","proc.pid.ts":"23451","proc.vpid":133569,"proc.pvpid":133570,"proc.sid":133571,"proc.sid.exepath":"/bin/event-generator","proc.sname":"containerd-shim","proc.is_sid_leader":true,"proc.is_vpgid_leader":false,"proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"hostname":"a2000de987ff","output":"2024-05-13T13:23:38.089890892+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=84c0b936c919 container_name=elastic-package-service-falco-event-generator-1)","priority":"Informational","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-13T13:23:38.089890892Z", "output_fields": {"container.id":"84c0b936c919","container.name":"elastic-package-service-falco-event-generator-1","evt.time":1715606609089890892,"evt.type":"openat","evt.res": "ENOENT","evt.failed":true,"fd.name":"/etc/shadow","proc.aname[2]":"runc","proc.aname[3]":"init","proc.aname[4]":"init","proc.cmdline":"event-generator run --loop","proc.pexepath":"/bin/event-generator","proc.exepath":"/bin/event-generator","proc.args":"run --loop -v","proc.name":"event-generator","proc.pname":"containerd-shim","proc.duration":"662789","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}
{"uuid":"7466e462-ddde-434d-8dee-390ca5656f83","output":"21:35:04.518808525: Notice A shell was spawned in a container with an attached terminal (evt_type=execve user=root user_uid=0 user_loginuid=-1 process=sh proc_exepath=/bin/sh parent=containerd-shim command=sh terminal=34816 exe_flags=EXE_WRITABLE container_id=8645a7a530c3 container_image=docker.io/library/busybox container_image_tag=latest container_name=debug k8s_ns=default k8s_pod_name=debug)","priority":"Notice","rule":"Terminal shell in container","time":"2024-08-28T21:35:04.518808525Z","output_fields":{"container.id":"8645a7a530c3","container.image.repository":"docker.io/library/busybox","container.image.tag":"latest","container.name":"debug","evt.arg.flags":"EXE_WRITABLE","evt.time":1724880904518808600,"evt.type":"execve","k8s.ns.name":"default","k8s.pod.name":"debug","proc.cmdline":"sh","proc.exepath":"/bin/sh","proc.name":"sh","proc.pname":"containerd-shim","proc.tty":34816,"user.loginuid":-1,"user.name":"root","user.uid":0},"source":"syscall","tags":["T1059","container","maturity_stable","mitre_execution","shell"],"hostname":"cluster-1-default-pool-131bf483-7km9"}
{"output":"13:12:32.137915184: Critical Executing binary not part of base image | proc_exe=openssl proc_sname=dpkg gparent=ca-certificates proc_exe_ino_ctime=1764940287915403498 proc_exe_ino_mtime=1758193968000000000 proc_exe_ino_ctime_duration_proc_start=64222342949 proc_cwd=/etc/ssl/certs/ container_start_ts=1764940319178262497 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=openssl proc_exepath=/usr/bin/openssl parent=update-ca-certi command=openssl rehash . terminal=34816 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER container_id=044d7c551e4a container_name=k8s_test-container_falco-test-pod_default_32d24baa-e844-4cdf-877e-6f51911bde7d_0 container_image_repository=ubuntu container_image_tag=latest k8s_pod_name=falco-test-pod k8s_ns_name=default","output_fields":{"evt_time":1764940352137915184},"hostname":"minikube","rule":"Drop and execute new binary in container","time":"2025-12-05T13:12:32.137915184Z","source":"syscall","priority":"Critical","uuid":"b791cbf1-245e-4574-9b91-f8f22a3bcbff","tags":["","PCI_DSS_11.5.1","TA0003","container","maturity_stable","mitre_persistence","process"]}