Initial commit

2026-08-21 05:26:49 +00:00 · 2026-03-09 20:21:35 -05:00
commit aacb8eebbe
314 changed files with 21766 additions and 0 deletions
@@ -0,0 +1,31 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: shell-execution-monitoring
+spec:
+  tracepoints:
+    - subsystem: raw_syscalls
+      event: sys_enter
+      args:
+        - index: 4
+          type: syscall64
+      selectors:
+        - matchArgs:
+            - index: 4
+              operator: Equal
+              values:
+                - "59"  # execve
+          matchBinaries:
+            - operator: In
+              values:
+                - /bin/sh
+                - /bin/bash
+                - /bin/dash
+                - /usr/bin/bash
+                - /usr/bin/sh
+                - /usr/bin/curl
+                - /usr/bin/wget
+                - /usr/bin/nc
+                - /usr/bin/ncat
+          matchActions:
+            - action: Post