apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: privilege-escalation-detection
spec:
  kprobes:
    - call: __x64_sys_setuid
      syscall: true
      return: false
      args:
        - index: 0
          type: int
          maxData: false
          resolve: ""
          returnCopy: false
      selectors:
        - matchArgs:
            - index: 0
              operator: Equal
              values:
                - "0"
          matchActions:
            - action: Post
    - call: __x64_sys_setgid
      syscall: true
      return: false
      args:
        - index: 0
          type: int
          maxData: false
          resolve: ""
          returnCopy: false
      selectors:
        - matchArgs:
            - index: 0
              operator: Equal
              values:
                - "0"
          matchActions:
            - action: Post