Software Bill of Behaviour for CNCF projects
What is an SBOB?
We introduce the Software “Bill of Behavior” (BoB): a vendor-supplied profile detailing known benign runtime behaviors for software, designed to be distributed directly within OCI artifacts. Generated using eBPF, a BoB codifies expected file access patterns, network communications, and capabilities. This empowers powerful, signature-less anomaly detection, allowing end-users to infer malicious activity or tampering in third-party software without the current burden of authoring and maintaining complex, custom security rules.
It solves the problem of distributing secure-by-default and up-to-date security rules for detection and defense.
Bill of Behavior: addresses the problem of distributing secure-by-default and up-to-date security rules for detection and defense- as it is supplied inside the application-packaging
Show your support and star ⭐️ the repo or get in contact
https://github.com/k8sstormcenter/bob
You can write to the authors using info@fusioncore.ai
Example 1 : Redis in four flavours
Step 1: Deploy the runtime agent, the rules and storage
We've implemented the SBOB functionality in CNCF Kubescape
Please to wait until storage and node-agent are ready, open a new tab new terminal and watch the kubescape alerts:
kubectl logs -n honey -l app=node-agent -c node-agent -f
wait for
{"level":"info","ts":"2026-08-02T18:01:36Z","msg":"ContainerWatcher started successfully"}
{"level":"info","ts":"2026-08-02T18:01:37Z","msg":"ContainerWatcher started successfully"}
Step 2: Deploy the Application
Redis is a famous key-value database that has been forked/imitated (lets skip the politics), and we have 2 deployments and 2 SBOBs here:
- a) Redis-OSS https://redis.io/open-source/
- b) KeyDB https://docs.keydb.dev/
cd ~/bob/example/redis/distros
./deploy-distros.sh redis sbob
./deploy-distros.sh keydb sbob
in the logs, wait for
{"level":"info","ts":"2026-08-02T18:02:53Z","msg":"container has a user defined profile","profile":"redis","container":"redis","workload":"redis-master-0"}
So, those two have the (more or less) identical functionality (in the repo, you ll also find valkey and dragonfly)
Should identical functionality mean identical SBOBs?
Should the bitnami chart have the identical SBOB to some other vendor?
No to both:
let's see some excerpts:
#cp-redis.yaml
capabilities:
- CAP_CHOWN
- CAP_DAC_OVERRIDE
- CAP_DAC_READ_SEARCH
- CAP_NET_ADMIN
- CAP_SETGID
- CAP_SETPCAP
- CAP_SETUID
- CAP_SYS_ADMIN
execs:
- args:
- /opt/bitnami/redis/bin/redis-server
- --port
- '6379'
- --protected-mode
...
#cp-keydb.yaml
capabilities:
- CAP_NET_ADMIN
- CAP_SETGID
- CAP_SETPCAP
- CAP_SETUID
- CAP_SYS_ADMIN
execs:
- args:
- /usr/local/bin/keydb-server
- /etc/keydb/redis.conf
- --active-replica
- 'yes'
...
As you can clearly see, those are very very distinct from a security perspective: different capabilities, different binaries, different argument etc.
This is important to understand, as so many people on Social Media claim you can infer a behavior somehow from the design using AI. That DOES NOT WORK
What does work? Using AI-agents to iterate over an actual applications' functional tests vs attack test and calibrate them for ideal contrast.
Step 2: Execute the app (redis) under Benign Behavior
Benign (adjective) bi-ˈnīn
- Benignity (noun) bi-ˈnig-nə-tē
- Benignly (adverb) bi-ˈnīn-lē
Definitions/SYNONYMS:
- Of a mild type or character that does not threaten health or life. HARMLESS.
- Of a gentle disposition: GRACIOUS.
- Showing kindness and gentleness. FAVORABLE, WHOLESOME.
/home/laborant/bobctl test --functional-tests functional/redis-oss.yaml -n redis
Running 86 functional tests against redis/redis-master:6379
Results: 86 passed, 0 failed, 0 errors (total 86)
Now try the other alternative
/home/laborant/bobctl test --functional-tests functional/keydb.yaml -n keydb
You should see no False Positives when you run the tests, and thats the main point: When using an application as intended, there are no alerts.
Step 3: Run the attack suite
/home/laborant/bobctl attack --attack-suite attacks/redis-oss.yaml -n redis
/home/laborant/bobctl attack --attack-suite attacks/keydb.yaml -n keydb
Ran 16 attacks from attacks/redis-oss.yaml
TYPE VARIANT CODE SUCCESS ERROR
--------------------------------------------------------------------------------
custom recon-info-server 0 YES
custom recon-config-dump 0 no
custom recon-client-list 0 no
cmdinject exec-whoami 0 YES
cmdinject dns-anomaly-lookup 0 YES
cmdinject sa-token-read 0 no
cmdinject k8s-api-unexpected-call 1 no
cmdinject exec-proc-environ 0 no
cmdinject exec-etc-shadow 1 no
cmdinject egress-external-c2 1 no
cmdinject drifted-binary-exec 0 YES
cmdinject exec-from-volume-mount 0 YES
fileless fileless-memfd-exec 1 no
cmdinject crypto-mining-dns 0 YES
cmdinject symlink-shadow 0 YES
cmdinject hardlink-shadow 0 no
whereas if we use keydb, we see a difference:
laborant@dev-machine:distros$ /home/laborant/bobctl attack --attack-suite attacks/keydb.yaml -n keydb
Ran 16 attacks from attacks/keydb.yaml
TYPE VARIANT CODE SUCCESS ERROR
--------------------------------------------------------------------------------
custom recon-info-server 0 YES
custom recon-config-dump 0 no
custom recon-client-list 0 no
cmdinject exec-whoami 0 YES
cmdinject dns-anomaly-lookup 0 YES
cmdinject sa-token-read 0 YES
cmdinject k8s-api-unexpected-call 0 YES
cmdinject exec-proc-environ 0 no
cmdinject exec-etc-shadow 0 no
cmdinject egress-external-c2 0 YES
cmdinject drifted-binary-exec 0 YES
cmdinject exec-from-volume-mount 0 YES
fileless fileless-memfd-exec 0 YES
cmdinject crypto-mining-dns 0 YES
cmdinject symlink-shadow 0 YES
cmdinject hardlink-shadow 0 no
And here are the actual detections for Redis-OSS
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/id","-u"],"exec":"/usr/bin/id","message":"Unexpected process launched: id with PID 16616"},"infectedPID":16616,"severity":1,"timestamp":"2026-08-02T18:05:56.084982556Z","trace":{},"uniqueID":"732769abf49bbc7bb1f0951239713b23","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"id","commandLine":"/usr/bin/id -u"},"file":{"name":"id","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16610,"cmdline":"/usr/bin/sh -c id -u \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo whoami_done","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"id␟16616":{"pid":16616,"cmdline":"/usr/bin/id -u","comm":"id","ppid":16610,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/id"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: id with PID 16616","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/getent","hosts","scanner.evil-c2.example.com"],"exec":"/usr/bin/getent","message":"Unexpected process launched: getent with PID 16635"},"infectedPID":16635,"severity":1,"size":"4.1 kB","timestamp":"2026-08-02T18:05:56.143932008Z","trace":{},"uniqueID":"958f7edb33b2256841523d9453bf7212","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"getent","commandLine":"/usr/bin/getent hosts scanner.evil-c2.example.com"},"file":{"name":"getent","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16629,"cmdline":"/usr/bin/sh -c getent hosts scanner.evil-c2.example.com \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo dns_resolved || echo dns_attempted","comm":"sh","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"getent␟16635":{"pid":16635,"cmdline":"/usr/bin/getent hosts scanner.evil-c2.example.com","comm":"getent","ppid":16629,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: getent with PID 16635","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/cat","/var/run/secrets/kubernetes.io/serviceaccount/token"],"exec":"/usr/bin/cat","message":"Unexpected process launched: cat with PID 16687"},"infectedPID":16687,"severity":1,"timestamp":"2026-08-02T18:05:56.293501193Z","trace":{},"uniqueID":"c72d283f13b6c19d97dcd2928d496ef2","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cat","commandLine":"/usr/bin/cat /var/run/secrets/kubernetes.io/serviceaccount/token"},"file":{"name":"cat","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16681,"cmdline":"/usr/bin/sh -c cat /var/run/secrets/kubernetes.io/serviceaccount/token \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo sa_token_read_done || echo sa_token_absent","comm":"sh","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"cat␟16687":{"pid":16687,"cmdline":"/usr/bin/cat /var/run/secrets/kubernetes.io/serviceaccount/token","comm":"cat","ppid":16681,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: cat with PID 16687","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY"],"message":"Unexpected file access detected: cat with PID 16687 to /local.sh","path":"/local.sh"},"infectedPID":16687,"severity":1,"timestamp":"2026-08-02T18:05:56.294086186Z","trace":{},"uniqueID":"a498aae9f51e79e35544681e9e9b73e4","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cat"},"file":{"name":"local.sh","directory":"/"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16681,"cmdline":"/usr/bin/sh -c cat /var/run/secrets/kubernetes.io/serviceaccount/token \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo sa_token_read_done || echo sa_token_absent","comm":"sh","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"cat␟16687":{"pid":16687,"cmdline":"/usr/bin/cat /var/run/secrets/kubernetes.io/serviceaccount/token","comm":"cat","ppid":16681,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: cat with PID 16687 to /local.sh","msg":"Files Access Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/cat","/proc/1/environ"],"exec":"/usr/bin/cat","message":"Unexpected process launched: cat with PID 16720"},"infectedPID":16720,"severity":1,"timestamp":"2026-08-02T18:05:56.398244474Z","trace":{},"uniqueID":"c72d283f13b6c19d97dcd2928d496ef2","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cat","commandLine":"/usr/bin/cat /proc/1/environ"},"file":{"name":"cat","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16720,"cmdline":"/usr/bin/cat /proc/1/environ","comm":"cat","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: cat with PID 16720","msg":"Unexpected process launched","processtree_depth":"1","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY"],"message":"Unexpected file access detected: cat with PID 16720 to /proc/1/environ","path":"/proc/1/environ"},"infectedPID":16720,"severity":1,"timestamp":"2026-08-02T18:05:56.39875215Z","trace":{},"uniqueID":"ef0be41dd87ff19a09544d8f86e520b5","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cat"},"file":{"name":"environ","directory":"/proc/1"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16720,"cmdline":"/usr/bin/cat /proc/1/environ","comm":"cat","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: cat with PID 16720 to /proc/1/environ","msg":"Files Access Anomalies in container","processtree_depth":"1","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Read Environment Variables from procfs","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY"],"message":"Reading environment variables from procfs: /proc/1/environ by process cat","path":"/proc/1/environ"},"infectedPID":16720,"severity":5,"timestamp":"2026-08-02T18:05:56.39875215Z","trace":{},"uniqueID":"ef0be41dd87ff19a09544d8f86e520b5","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cat"},"file":{"name":"environ","directory":"/proc/1"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0008","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16720,"cmdline":"/usr/bin/cat /proc/1/environ","comm":"cat","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Reading environment variables from procfs: /proc/1/environ by process cat","msg":"Read Environment Variables from procfs","processtree_depth":"1","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/cat","/etc/shadow"],"exec":"/usr/bin/cat","message":"Unexpected process launched: cat with PID 16738"},"infectedPID":16738,"severity":1,"timestamp":"2026-08-02T18:05:56.596136945Z","trace":{},"uniqueID":"c72d283f13b6c19d97dcd2928d496ef2","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cat","commandLine":"/usr/bin/cat /etc/shadow"},"file":{"name":"cat","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16738,"cmdline":"/usr/bin/cat /etc/shadow","comm":"cat","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: cat with PID 16738","msg":"Unexpected process launched","processtree_depth":"1","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY"],"message":"Unexpected file access detected: cat with PID 16738 to /etc/shadow","path":"/etc/shadow"},"infectedPID":16738,"severity":1,"timestamp":"2026-08-02T18:05:56.598327751Z","trace":{},"uniqueID":"0bda493c4e20c5f03b7f1c6aac26b518","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cat"},"file":{"name":"shadow","directory":"/etc"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16738,"cmdline":"/usr/bin/cat /etc/shadow","comm":"cat","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: cat with PID 16738 to /etc/shadow","msg":"Files Access Anomalies in container","processtree_depth":"1","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected Sensitive File Access","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY"],"message":"Unexpected sensitive file access: /etc/shadow by process cat","path":"/etc/shadow"},"infectedPID":16738,"severity":5,"timestamp":"2026-08-02T18:05:56.598327751Z","trace":{},"uniqueID":"0bda493c4e20c5f03b7f1c6aac26b518","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0,"profileDependency":1},"identifiers":{"process":{"name":"cat"},"file":{"name":"shadow","directory":"/etc"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0010","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16738,"cmdline":"/usr/bin/cat /etc/shadow","comm":"cat","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected sensitive file access: /etc/shadow by process cat","msg":"Unexpected Sensitive File Access","processtree_depth":"1","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY"],"message":"Unexpected file access detected: cp with PID 16782 to /usr/bin/ls","path":"/usr/bin/ls"},"infectedPID":16782,"severity":1,"timestamp":"2026-08-02T18:05:56.712823047Z","trace":{},"uniqueID":"b5fff3e55f29d8bd5eef832b70d19b3e","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cp"},"file":{"name":"ls","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16776,"cmdline":"/usr/bin/sh -c cp /bin/ls /data/drifted_bob \u0026\u0026 printf '\\n#bob-drift' \u003e\u003e /data/drifted_bob \u0026\u0026 chmod +x /data/drifted_bob \u0026\u0026 /data/drifted_bob / \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo drift_exec_done; rm -f /data/drifted_bob","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"cp␟16782":{"pid":16782,"cmdline":"/usr/bin/cp /bin/ls /data/drifted_bob","comm":"cp","ppid":16776,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cp"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: cp with PID 16782 to /usr/bin/ls","msg":"Files Access Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/data/drifted_bob","/"],"exec":"/data/drifted_bob","message":"Unexpected process launched: drifted_bob with PID 16784"},"infectedPID":16784,"severity":1,"timestamp":"2026-08-02T18:05:56.713821173Z","trace":{},"uniqueID":"4b8a0b849572b1917245f455d108c721","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"drifted_bob","commandLine":"/data/drifted_bob /"},"file":{"name":"drifted_bob","directory":"/data"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16776,"cmdline":"/usr/bin/sh -c cp /bin/ls /data/drifted_bob \u0026\u0026 printf '\\n#bob-drift' \u003e\u003e /data/drifted_bob \u0026\u0026 chmod +x /data/drifted_bob \u0026\u0026 /data/drifted_bob / \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo drift_exec_done; rm -f /data/drifted_bob","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"drifted_bob␟16784":{"pid":16784,"cmdline":"/data/drifted_bob /","comm":"drifted_bob","ppid":16776,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/data/drifted_bob"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: drifted_bob with PID 16784","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/rm","-f","/data/drifted_bob"],"exec":"/usr/bin/rm","message":"Unexpected process launched: rm with PID 16776"},"infectedPID":16776,"severity":1,"timestamp":"2026-08-02T18:05:56.714400271Z","trace":{},"uniqueID":"415e75cd1e3b8d1acb10b6a2e4f97e4e","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"rm","commandLine":"/usr/bin/rm -f /data/drifted_bob"},"file":{"name":"rm","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16776,"cmdline":"/usr/bin/rm -f /data/drifted_bob","comm":"rm","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/rm"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: rm with PID 16776","msg":"Unexpected process launched","processtree_depth":"1","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_WRONLY","O_CREAT","O_EXCL"],"message":"Unexpected file access detected: cp with PID 16782 to /data/drifted_bob","path":"/data/drifted_bob"},"infectedPID":16782,"severity":1,"timestamp":"2026-08-02T18:05:56.712841937Z","trace":{},"uniqueID":"fa9f768935fe0e39f9e91decedd41303","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cp"},"file":{"name":"drifted_bob","directory":"/data"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16776,"cmdline":"/usr/bin/sh -c cp /bin/ls /data/drifted_bob \u0026\u0026 printf '\\n#bob-drift' \u003e\u003e /data/drifted_bob \u0026\u0026 chmod +x /data/drifted_bob \u0026\u0026 /data/drifted_bob / \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo drift_exec_done; rm -f /data/drifted_bob","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"cp␟16782":{"pid":16782,"cmdline":"/usr/bin/cp /bin/ls /data/drifted_bob","comm":"cp","ppid":16776,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cp"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: cp with PID 16782 to /data/drifted_bob","msg":"Files Access Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Process executed from mount","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/data/drifted_bob","/"],"exec":"/data/drifted_bob","message":"Process (drifted_bob) was executed from a mounted path"},"infectedPID":16784,"severity":5,"timestamp":"2026-08-02T18:05:56.713821173Z","trace":{},"uniqueID":"2a86c3a2dfa4928d9445bb1d68814cdc","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0,"profileDependency":1},"identifiers":{"process":{"name":"drifted_bob","commandLine":"/data/drifted_bob /"},"file":{"name":"drifted_bob","directory":"/data"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R1004","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16776,"cmdline":"/usr/bin/sh -c cp /bin/ls /data/drifted_bob \u0026\u0026 printf '\\n#bob-drift' \u003e\u003e /data/drifted_bob \u0026\u0026 chmod +x /data/drifted_bob \u0026\u0026 /data/drifted_bob / \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo drift_exec_done; rm -f /data/drifted_bob","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"drifted_bob␟16784":{"pid":16784,"cmdline":"/data/drifted_bob /","comm":"drifted_bob","ppid":16776,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/data/drifted_bob"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Process (drifted_bob) was executed from a mounted path","msg":"Process executed from mount","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY","O_NONBLOCK","O_DIRECTORY","O_CLOEXEC"],"message":"Unexpected file access detected: drifted_bob with PID 16784 to /","path":"/"},"infectedPID":16784,"severity":1,"timestamp":"2026-08-02T18:05:56.714199435Z","trace":{},"uniqueID":"0dea87726dc65709554c33c5b1543cbe","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"drifted_bob"},"file":{"name":"/","directory":"/"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16776,"cmdline":"/usr/bin/sh -c cp /bin/ls /data/drifted_bob \u0026\u0026 printf '\\n#bob-drift' \u003e\u003e /data/drifted_bob \u0026\u0026 chmod +x /data/drifted_bob \u0026\u0026 /data/drifted_bob / \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo drift_exec_done; rm -f /data/drifted_bob","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"drifted_bob␟16784":{"pid":16784,"cmdline":"/data/drifted_bob /","comm":"drifted_bob","ppid":16776,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/data/drifted_bob"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: drifted_bob with PID 16784 to /","msg":"Files Access Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/chmod","+x","/data/drifted_bob"],"exec":"/usr/bin/chmod","message":"Unexpected process launched: chmod with PID 16783"},"infectedPID":16783,"severity":1,"timestamp":"2026-08-02T18:05:56.713330577Z","trace":{},"uniqueID":"0cd686e109dea6e6075a9eaa9ad77738","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"chmod","commandLine":"/usr/bin/chmod +x /data/drifted_bob"},"file":{"name":"chmod","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16776,"cmdline":"/usr/bin/sh -c cp /bin/ls /data/drifted_bob \u0026\u0026 printf '\\n#bob-drift' \u003e\u003e /data/drifted_bob \u0026\u0026 chmod +x /data/drifted_bob \u0026\u0026 /data/drifted_bob / \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo drift_exec_done; rm -f /data/drifted_bob","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"chmod␟16783":{"pid":16783,"cmdline":"/usr/bin/chmod +x /data/drifted_bob","comm":"chmod","ppid":16776,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/chmod"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: chmod with PID 16783","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_WRONLY","O_CREAT","O_APPEND"],"message":"Unexpected file access detected: sh with PID 16776 to /data/drifted_bob","path":"/data/drifted_bob"},"infectedPID":16776,"severity":1,"timestamp":"2026-08-02T18:05:56.713179935Z","trace":{},"uniqueID":"ce8cf27b1b89dd822af4bc9a95f561f1","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"sh"},"file":{"name":"drifted_bob","directory":"/data"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16776,"cmdline":"/usr/bin/sh -c cp /bin/ls /data/drifted_bob \u0026\u0026 printf '\\n#bob-drift' \u003e\u003e /data/drifted_bob \u0026\u0026 chmod +x /data/drifted_bob \u0026\u0026 /data/drifted_bob / \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo drift_exec_done; rm -f /data/drifted_bob","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: sh with PID 16776 to /data/drifted_bob","msg":"Files Access Anomalies in container","processtree_depth":"1","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY","O_DIRECTORY"],"message":"Unexpected file access detected: cp with PID 16782 to /data/drifted_bob","path":"/data/drifted_bob"},"infectedPID":16782,"severity":1,"timestamp":"2026-08-02T18:05:56.712807287Z","trace":{},"uniqueID":"fa9f768935fe0e39f9e91decedd41303","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cp"},"file":{"name":"drifted_bob","directory":"/data"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16776,"cmdline":"/usr/bin/sh -c cp /bin/ls /data/drifted_bob \u0026\u0026 printf '\\n#bob-drift' \u003e\u003e /data/drifted_bob \u0026\u0026 chmod +x /data/drifted_bob \u0026\u0026 /data/drifted_bob / \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo drift_exec_done; rm -f /data/drifted_bob","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"cp␟16782":{"pid":16782,"cmdline":"/usr/bin/cp /bin/ls /data/drifted_bob","comm":"cp","ppid":16776,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cp"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: cp with PID 16782 to /data/drifted_bob","msg":"Files Access Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:56Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/rm","-f","/data/mnt_payload"],"exec":"/usr/bin/rm","message":"Unexpected process launched: rm with PID 16799"},"infectedPID":16799,"severity":1,"timestamp":"2026-08-02T18:05:57.201792936Z","trace":{},"uniqueID":"415e75cd1e3b8d1acb10b6a2e4f97e4e","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"rm","commandLine":"/usr/bin/rm -f /data/mnt_payload"},"file":{"name":"rm","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16799,"cmdline":"/usr/bin/rm -f /data/mnt_payload","comm":"rm","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/rm"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: rm with PID 16799","msg":"Unexpected process launched","processtree_depth":"1","time":"2026-08-02T18:05:57Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/chmod","+x","/data/mnt_payload"],"exec":"/usr/bin/chmod","message":"Unexpected process launched: chmod with PID 16819"},"infectedPID":16819,"severity":1,"timestamp":"2026-08-02T18:05:57.200219469Z","trace":{},"uniqueID":"0cd686e109dea6e6075a9eaa9ad77738","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"chmod","commandLine":"/usr/bin/chmod +x /data/mnt_payload"},"file":{"name":"chmod","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16799,"cmdline":"/usr/bin/sh -c cp /bin/echo /data/mnt_payload \u0026\u0026 chmod +x /data/mnt_payload \u0026\u0026 /data/mnt_payload mount_exec_done; rm -f /data/mnt_payload","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"chmod␟16819":{"pid":16819,"cmdline":"/usr/bin/chmod +x /data/mnt_payload","comm":"chmod","ppid":16799,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/chmod"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: chmod with PID 16819","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-08-02T18:05:57Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_WRONLY","O_CREAT","O_EXCL"],"message":"Unexpected file access detected: cp with PID 16816 to /data/mnt_payload","path":"/data/mnt_payload"},"infectedPID":16816,"severity":1,"timestamp":"2026-08-02T18:05:57.199659514Z","trace":{},"uniqueID":"08e898e1d6912509e5304c9a45189554","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cp"},"file":{"name":"mnt_payload","directory":"/data"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16799,"cmdline":"/usr/bin/sh -c cp /bin/echo /data/mnt_payload \u0026\u0026 chmod +x /data/mnt_payload \u0026\u0026 /data/mnt_payload mount_exec_done; rm -f /data/mnt_payload","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"cp␟16816":{"pid":16816,"cmdline":"/usr/bin/cp /bin/echo /data/mnt_payload","comm":"cp","ppid":16799,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cp"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: cp with PID 16816 to /data/mnt_payload","msg":"Files Access Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:57Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY","O_DIRECTORY"],"message":"Unexpected file access detected: cp with PID 16816 to /data/mnt_payload","path":"/data/mnt_payload"},"infectedPID":16816,"severity":1,"timestamp":"2026-08-02T18:05:57.19959441Z","trace":{},"uniqueID":"08e898e1d6912509e5304c9a45189554","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cp"},"file":{"name":"mnt_payload","directory":"/data"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16799,"cmdline":"/usr/bin/sh -c cp /bin/echo /data/mnt_payload \u0026\u0026 chmod +x /data/mnt_payload \u0026\u0026 /data/mnt_payload mount_exec_done; rm -f /data/mnt_payload","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"cp␟16816":{"pid":16816,"cmdline":"/usr/bin/cp /bin/echo /data/mnt_payload","comm":"cp","ppid":16799,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cp"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: cp with PID 16816 to /data/mnt_payload","msg":"Files Access Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:57Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/data/mnt_payload","mount_exec_done"],"exec":"/data/mnt_payload","message":"Unexpected process launched: mnt_payload with PID 16824"},"infectedPID":16824,"severity":1,"timestamp":"2026-08-02T18:05:57.201125148Z","trace":{},"uniqueID":"054fd3c2fa7abacfeb754baf22bab0ce","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"mnt_payload","commandLine":"/data/mnt_payload mount_exec_done"},"file":{"name":"mnt_payload","directory":"/data"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16799,"cmdline":"/usr/bin/sh -c cp /bin/echo /data/mnt_payload \u0026\u0026 chmod +x /data/mnt_payload \u0026\u0026 /data/mnt_payload mount_exec_done; rm -f /data/mnt_payload","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"mnt_payload␟16824":{"pid":16824,"cmdline":"/data/mnt_payload mount_exec_done","comm":"mnt_payload","ppid":16799,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/data/mnt_payload"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: mnt_payload with PID 16824","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-08-02T18:05:57Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","flags":["O_RDONLY"],"message":"Unexpected file access detected: cp with PID 16816 to /usr/bin/echo","path":"/usr/bin/echo"},"infectedPID":16816,"severity":1,"timestamp":"2026-08-02T18:05:57.199623878Z","trace":{},"uniqueID":"d8dbab6f4e21489695c3b3ac146f4ae3","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"cp"},"file":{"name":"echo","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16799,"cmdline":"/usr/bin/sh -c cp /bin/echo /data/mnt_payload \u0026\u0026 chmod +x /data/mnt_payload \u0026\u0026 /data/mnt_payload mount_exec_done; rm -f /data/mnt_payload","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"cp␟16816":{"pid":16816,"cmdline":"/usr/bin/cp /bin/echo /data/mnt_payload","comm":"cp","ppid":16799,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cp"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected file access detected: cp with PID 16816 to /usr/bin/echo","msg":"Files Access Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:57Z"}
{"BaseRuntimeMetadata":{"alertName":"Process executed from mount","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/data/mnt_payload","mount_exec_done"],"exec":"/data/mnt_payload","message":"Process (mnt_payload) was executed from a mounted path"},"infectedPID":16824,"severity":5,"timestamp":"2026-08-02T18:05:57.201125148Z","trace":{},"uniqueID":"c53e2a3d8dd009e332a695c2a571892e","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0,"profileDependency":1},"identifiers":{"process":{"name":"mnt_payload","commandLine":"/data/mnt_payload mount_exec_done"},"file":{"name":"mnt_payload","directory":"/data"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R1004","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16799,"cmdline":"/usr/bin/sh -c cp /bin/echo /data/mnt_payload \u0026\u0026 chmod +x /data/mnt_payload \u0026\u0026 /data/mnt_payload mount_exec_done; rm -f /data/mnt_payload","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"mnt_payload␟16824":{"pid":16824,"cmdline":"/data/mnt_payload mount_exec_done","comm":"mnt_payload","ppid":16799,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/data/mnt_payload"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Process (mnt_payload) was executed from a mounted path","msg":"Process executed from mount","processtree_depth":"2","time":"2026-08-02T18:05:57Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/getent","hosts","xmr.pool.minergate.com"],"exec":"/usr/bin/getent","message":"Unexpected process launched: getent with PID 16899"},"infectedPID":16899,"severity":1,"size":"4.1 kB","timestamp":"2026-08-02T18:05:57.805486369Z","trace":{},"uniqueID":"958f7edb33b2256841523d9453bf7212","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"getent","commandLine":"/usr/bin/getent hosts xmr.pool.minergate.com"},"file":{"name":"getent","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16887,"cmdline":"/usr/bin/sh -c getent hosts xmr.pool.minergate.com \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo miner_dns_ok || echo miner_dns_attempted","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"getent␟16899":{"pid":16899,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":16887,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: getent with PID 16899","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-08-02T18:05:57Z"}
{"BaseRuntimeMetadata":{"alertName":"DNS Anomalies in container","arguments":{"addresses":null,"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","domain":"xmr.pool.minergate.com.","message":"Unexpected domain communication: xmr.pool.minergate.com. from: redis","port":60042,"protocol":"UDP"},"infectedPID":16899,"severity":1,"timestamp":"2026-08-02T18:05:58.006624473Z","trace":{},"uniqueID":"53fb4d02b87d933de81a69c3ed2a059c","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":1},"identifiers":{"process":{"name":"getent"},"dns":{"domain":"xmr.pool.minergate.com."},"network":{"protocol":"UDP"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0005","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16887,"cmdline":"/usr/bin/sh -c getent hosts xmr.pool.minergate.com \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo miner_dns_ok || echo miner_dns_attempted","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"getent␟16899":{"pid":16899,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":16887,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected domain communication: xmr.pool.minergate.com. from: redis","msg":"DNS Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:58Z"}
{"BaseRuntimeMetadata":{"alertName":"DNS Anomalies in container","arguments":{"addresses":["49.12.80.38","49.12.80.40","49.12.80.39"],"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","domain":"xmr.pool.minergate.com.","message":"Unexpected domain communication: xmr.pool.minergate.com. from: redis","port":38868,"protocol":"UDP"},"infectedPID":16899,"severity":1,"timestamp":"2026-08-02T18:05:58.019468914Z","trace":{},"uniqueID":"53fb4d02b87d933de81a69c3ed2a059c","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":1},"identifiers":{"process":{"name":"getent"},"dns":{"domain":"xmr.pool.minergate.com."},"network":{"dstIP":"49.12.80.38","protocol":"UDP"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0005","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16887,"cmdline":"/usr/bin/sh -c getent hosts xmr.pool.minergate.com \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo miner_dns_ok || echo miner_dns_attempted","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"getent␟16899":{"pid":16899,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":16887,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected domain communication: xmr.pool.minergate.com. from: redis","msg":"DNS Anomalies in container","processtree_depth":"2","time":"2026-08-02T18:05:58Z"}
{"BaseRuntimeMetadata":{"alertName":"Crypto Mining Domain Communication","arguments":{"addresses":null,"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","domain":"xmr.pool.minergate.com.","message":"Communication with a known crypto mining domain: xmr.pool.minergate.com.","port":60042,"protocol":"UDP"},"infectedPID":16899,"severity":10,"timestamp":"2026-08-02T18:05:58.006624473Z","trace":{},"uniqueID":"41b6ce338bcdf94750924d7fa9462f26","identifiers":{"process":{"name":"getent"},"dns":{"domain":"xmr.pool.minergate.com."},"network":{"protocol":"UDP"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R1008","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16887,"cmdline":"/usr/bin/sh -c getent hosts xmr.pool.minergate.com \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo miner_dns_ok || echo miner_dns_attempted","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"getent␟16899":{"pid":16899,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":16887,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Communication with a known crypto mining domain: xmr.pool.minergate.com.","msg":"Crypto Mining Domain Communication","processtree_depth":"2","time":"2026-08-02T18:05:58Z"}
{"BaseRuntimeMetadata":{"alertName":"Crypto Mining Domain Communication","arguments":{"addresses":["49.12.80.38","49.12.80.40","49.12.80.39"],"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","domain":"xmr.pool.minergate.com.","message":"Communication with a known crypto mining domain: xmr.pool.minergate.com.","port":38868,"protocol":"UDP"},"infectedPID":16899,"severity":10,"timestamp":"2026-08-02T18:05:58.019468914Z","trace":{},"uniqueID":"41b6ce338bcdf94750924d7fa9462f26","identifiers":{"process":{"name":"getent"},"dns":{"domain":"xmr.pool.minergate.com."},"network":{"dstIP":"49.12.80.38","protocol":"UDP"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R1008","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16887,"cmdline":"/usr/bin/sh -c getent hosts xmr.pool.minergate.com \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo miner_dns_ok || echo miner_dns_attempted","comm":"sh","ppid":10251,"pcomm":"runc","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"getent␟16899":{"pid":16899,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":16887,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Communication with a known crypto mining domain: xmr.pool.minergate.com.","msg":"Crypto Mining Domain Communication","processtree_depth":"2","time":"2026-08-02T18:05:58Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/ln","-sf","/etc/shadow","/data/softlink_probe"],"exec":"/usr/bin/ln","message":"Unexpected process launched: ln with PID 16912"},"infectedPID":16912,"severity":1,"timestamp":"2026-08-02T18:05:58.092572575Z","trace":{},"uniqueID":"55cb8f7d685576caecc2cbd2c1c9124a","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"ln","commandLine":"/usr/bin/ln -sf /etc/shadow /data/softlink_probe"},"file":{"name":"ln","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16912,"cmdline":"/usr/bin/ln -sf /etc/shadow /data/softlink_probe","comm":"ln","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/ln"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: ln with PID 16912","msg":"Unexpected process launched","processtree_depth":"1","time":"2026-08-02T18:05:58Z"}
{"BaseRuntimeMetadata":{"alertName":"Soft link created over sensitive file","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","message":"Symlink created over sensitive file: /etc/shadow -\u003e /data/softlink_probe","newPath":"/data/softlink_probe","oldPath":"/etc/shadow"},"infectedPID":16912,"severity":5,"timestamp":"2026-08-02T18:05:58.093147654Z","trace":{},"uniqueID":"4a4e0471968a66bd7c8c67a83d95a437","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0,"profileDependency":1},"identifiers":{"process":{"name":"ln"},"file":{"name":"shadow","directory":"/etc"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R1010","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16912,"cmdline":"/usr/bin/ln -sf /etc/shadow /data/softlink_probe","comm":"ln","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/ln"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Symlink created over sensitive file: /etc/shadow -\u003e /data/softlink_probe","msg":"Soft link created over sensitive file","processtree_depth":"1","time":"2026-08-02T18:05:58Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/ln","/etc/shadow","/data/hl_probe"],"exec":"/usr/bin/ln","message":"Unexpected process launched: ln with PID 16936"},"infectedPID":16936,"severity":1,"timestamp":"2026-08-02T18:05:58.197797314Z","trace":{},"uniqueID":"55cb8f7d685576caecc2cbd2c1c9124a","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"ln","commandLine":"/usr/bin/ln /etc/shadow /data/hl_probe"},"file":{"name":"ln","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16930,"cmdline":"/usr/bin/sh -c ln /etc/shadow /data/hl_probe \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo hardlink_done; rm -f /data/hl_probe","comm":"sh","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"ln␟16936":{"pid":16936,"cmdline":"/usr/bin/ln /etc/shadow /data/hl_probe","comm":"ln","ppid":16930,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/ln"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: ln with PID 16936","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-08-02T18:05:58Z"}
{"BaseRuntimeMetadata":{"alertName":"Hard link created over sensitive file","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","message":"Hardlink created over sensitive file: /etc/shadow - /data/hl_probe","newPath":"/data/hl_probe","oldPath":"/etc/shadow"},"infectedPID":16936,"severity":5,"timestamp":"2026-08-02T18:05:58.199034227Z","trace":{},"uniqueID":"4a4e0471968a66bd7c8c67a83d95a437","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0,"profileDependency":1},"identifiers":{"process":{"name":"ln"},"file":{"name":"shadow","directory":"/etc"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R1012","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16930,"cmdline":"/usr/bin/sh -c ln /etc/shadow /data/hl_probe \u003e/dev/null 2\u003e\u00261 \u0026\u0026 echo hardlink_done; rm -f /data/hl_probe","comm":"sh","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/bash","childrenMap":{"ln␟16936":{"pid":16936,"cmdline":"/usr/bin/ln /etc/shadow /data/hl_probe","comm":"ln","ppid":16930,"pcomm":"sh","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/ln"}}},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Hardlink created over sensitive file: /etc/shadow - /data/hl_probe","msg":"Hard link created over sensitive file","processtree_depth":"2","time":"2026-08-02T18:05:58Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"b31b2189db4c3dd56964c10d4b6c0d05b84074112437fac94a13900fef47a45d","args":["/usr/bin/rm","-f","/data/hl_probe"],"exec":"/usr/bin/rm","message":"Unexpected process launched: rm with PID 16930"},"infectedPID":16930,"severity":1,"timestamp":"2026-08-02T18:05:58.199664869Z","trace":{},"uniqueID":"415e75cd1e3b8d1acb10b6a2e4f97e4e","profileMetadata":{"status":"completed","completion":"complete","name":"redis","failOnProfile":true,"type":0},"identifiers":{"process":{"name":"rm","commandLine":"/usr/bin/rm -f /data/hl_probe"},"file":{"name":"rm","directory":"/usr/bin"}},"agentVersion":"sbob-rc5s-fpo"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"registry-1.docker.io/bitnami/redis@sha256:08863c2c3f4e051fb6139b38fa223e9c13be5033326a59bead182860d899bf98","imageDigest":"sha256:6ebb8c34e1d10f475e64ff006b98b4701e0019efcd29327e73e7e8881033fda1","namespace":"redis","containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093","podName":"redis-master-0","podNamespace":"redis","podUID":"c744b311-8caa-46b2-b845-633dd47a804c","podLabels":{"app.kubernetes.io/component":"master","app.kubernetes.io/instance":"redis","app.kubernetes.io/managed-by":"Helm","app.kubernetes.io/name":"redis","app.kubernetes.io/version":"8.8.1","apps.kubernetes.io/pod-index":"0","controller-revision-hash":"redis-master-7b754b5498","helm.sh/chart":"redis-27.0.18","kubescape.io/user-defined-profile":"redis","statefulset.kubernetes.io/pod-name":"redis-master-0"},"workloadName":"redis-master","workloadNamespace":"redis","workloadKind":"StatefulSet","workloadUID":"2a4ee3b3-9a6e-4654-a634-5f761ba2296e"},"RuntimeProcessDetails":{"processTree":{"pid":16930,"cmdline":"/usr/bin/rm -f /data/hl_probe","comm":"rm","ppid":10251,"pcomm":"containerd-shim","uid":1001,"gid":1001,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/rm"},"containerID":"237fac3102cadecbbda5625ee380ec019d65f56eabda422089d634d8d2e7b093"},"level":"error","message":"Unexpected process launched: rm with PID 16930","msg":"Unexpected process launched","processtree_depth":"1","time":"2026-08-02T18:05:58Z"}
Congrats, you've successfully verified how for these 2 different redis-flavours in their respective deployment methods, you can detect different mock-attacks.
Please remember to calibrate this to your system , if you use very different params in the helm chart, the results may differ. For an example of how to add an allowed client, stay tuned for the next update of this lab.
Brought to you by Kubescape
Also check out the official documentation on kubescape.io