Homelabv4/infrastructure/tetragon/tracing-policies/privilege-escalation.yaml

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: privilege-escalation-detection
spec:
  kprobes:
    - call: __x64_sys_setuid
      syscall: true
      args:
        - index: 0
          type: int
      selectors:
        - matchArgs:
            - index: 0
              operator: Equal
              values:
                - "0"
          matchActions:
            - action: Post
    - call: __x64_sys_setgid
      syscall: true
      args:
        - index: 0
          type: int
      selectors:
        - matchArgs:
            - index: 0
              operator: Equal
              values:
                - "0"
          matchActions:
            - action: Post