apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: shell-execution-monitoring
spec:
  tracepoints:
    - subsystem: raw_syscalls
      event: sys_enter
      args:
        - index: 4
          type: syscall64
      selectors:
        - matchArgs:
            - index: 4
              operator: Equal
              values:
                - "59"  # execve
          matchBinaries:
            - operator: In
              values:
                - /bin/sh
                - /bin/bash
                - /bin/dash
                - /usr/bin/bash
                - /usr/bin/sh
                - /usr/bin/curl
                - /usr/bin/wget
                - /usr/bin/nc
                - /usr/bin/ncat
          matchActions:
            - action: Post