16 lines
346 B
YAML
16 lines
346 B
YAML
- rule: custom_rule
|
|
desc: custom_rule
|
|
source: syscall
|
|
condition: >
|
|
(evt.type in (execve, execveat)) and
|
|
container.id != host and
|
|
k8s.ns.name = "payments" and
|
|
(proc.name = bash or
|
|
proc.name = sh)
|
|
output: >
|
|
%k8s.pod.name,%k8s.ns.name,%proc.cmdline,%container.name
|
|
priority: WARNING
|
|
tags: [container,mitre_execution]
|
|
|
|
|