- rule: custom_rule
  desc: custom_rule
  source: syscall
  condition: >
   (evt.type in (execve, execveat)) and
   container.id != host and
   k8s.ns.name = "payments" and
   (proc.name = bash or
   proc.name = sh)
  output: >
   %k8s.pod.name,%k8s.ns.name,%proc.cmdline,%container.name
  priority: WARNING
  tags: [container,mitre_execution]