=== Eventos CRITICAL de Falco (malware-like behavior) ===
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
TIME    : 2026-05-27T13:53:49.033275184Z
RULE    : Drop and execute new binary in container
PRIORITY: Critical
OUTPUT  : 13:53:49.033275184: Critical Executing binary not part of base image | proc_exe=ss proc_sname=ss gparent=systemd proc_exe_ino_ctime=1779890016634130041 proc_exe_ino_mtime=4488319282506139136 proc_exe_ino_ctime_duration_proc_start=12358834237 proc_cwd=/ container_start_ts=1779603492000000000 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ss proc_exepath=/sbin/ss parent=containerd-shim command=ss -tlnp terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER container_id=012b52d2eb01 container_name=inspector container_image_repository=docker.io/library/alpine container_image_tag=latest k8s_pod_name=cde-inspector k8s_ns_name=default
TAGS    : ['PCI_DSS_11.5.1', 'TA0003', 'container', 'maturity_stable', 'mitre_persistence', 'process']
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
TIME    : 2026-05-27T13:53:49.795445210Z
RULE    : Drop and execute new binary in container
PRIORITY: Critical
OUTPUT  : 13:53:49.795445210: Critical Executing binary not part of base image | proc_exe=ss proc_sname=ss gparent=systemd proc_exe_ino_ctime=1779890016634130041 proc_exe_ino_mtime=4488319282506139136 proc_exe_ino_ctime_duration_proc_start=13118046393 proc_cwd=/ container_start_ts=1779603492000000000 evt_type=execve user=root user_uid=0 user_loginuid=-1 process=ss proc_exepath=/sbin/ss parent=containerd-shim command=ss -ulnp terminal=0 exe_flags=EXE_WRITABLE|EXE_UPPER_LAYER container_id=012b52d2eb01 container_name=inspector container_image_repository=docker.io/library/alpine container_image_tag=latest k8s_pod_name=cde-inspector k8s_ns_name=default
TAGS    : ['PCI_DSS_11.5.1', 'TA0003', 'container', 'maturity_stable', 'mitre_persistence', 'process']
