{
    "@timestamp": "2024-09-12T13:06:12.675Z",
    "agent": {
        "ephemeral_id": "fe172d2f-7b14-4b87-bc5a-acc14684e4c5",
        "id": "58014837",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.14.1"
    },
    "cloud": {
        "account": {
            "id": "289645096542"
        },
        "availability_zone": "us-central1-c",
        "instance": {
            "id": "648229130641697246",
            "name": "gke-cluster-gcp-demo-san-default-pool-66250c41-vd1o"
        },
        "machine": {
            "type": "e2-standard-4"
        },
        "project": {
            "id": "289645096542",
            "name": "alliances-chronicle"
        },
        "provider": "gcp",
        "region": "us-central1"
    },
    "container": {
        "id": "6949e5f10829"
    },
    "data_stream": {
        "dataset": "sysdig.alerts",
        "namespace": "15372",
        "type": "logs"
    },
    "ecs": {
        "version": "8.0.0"
    },
    "elastic_agent": {
        "id": "a2d71da8-f67f-43fa-a895-0251c4a68bb0",
        "snapshot": false,
        "version": "8.14.1"
    },
    "event": {
        "agent_id_status": "mismatch",
        "dataset": "sysdig.alerts",
        "id": "17dec715376910362c8c3f62a4ceda2e",
        "ingested": "2024-09-12T13:06:22Z",
        "kind": "alert",
        "provider": "syscall",
        "severity": 7,
        "timezone": "+00:00"
    },
    "host": {
        "id": "42:01:0a:80:00:05",
        "mac": [
            "42-01-0A-80-00-05"
        ],
        "name": "gke-cluster-gcp-demo-san-default-pool-66250c41-vd1o"
    },
    "input": {
        "type": "http_endpoint"
    },
    "log": {
        "syslog": {
            "severity": {
                "code": 7,
                "name": "debug"
            }
        }
    },
    "message": "Users management command userdel tmp_suid_user launched by pwsh on threatgen under user root (proc.name=userdel proc.args=tmp_suid_user fd.name=<NA> proc.cmdline=pwsh -c (./RunTests.ps1 STDIN.NETWORK DEV.SHM.EXEC T1048 RECON.FIND.SUID T1611.002 CONTAINER.ESCAPE.NSENTER CREDS.DUMP.MEMORY KILL.MALICIOUS.PROC LOAD.BPF.PROG Base64.PYTHON BASE64.CLI CONNECT.UNEXPECTED RECON.GPG SUBTERFUGE.LASTLOG LD.LINUX.EXEC LD.SO.PRELOAD USERFAULTFD.HANDLER RECON.LINPEAS PROOT.EXEC) proc.pname=pwsh gparent=containerd-shim ggparent=<NA> gggparent=<NA> container=container_id=6949e5f10829 container_name=threatgen evt.type=execve evt.arg.request=<NA> proc.pid=2140169 proc.cwd=/tmp/ proc.ppid=2140088 proc.pcmdline=pwsh -c (./RunTests.ps1 STDIN.NETWORK DEV.SHM.EXEC T1048 RECON.FIND.SUID T1611.002 CONTAINER.ESCAPE.NSENTER CREDS.DUMP.MEMORY KILL.MALICIOUS.PROC LOAD.BPF.PROG Base64.PYTHON BASE64.CLI CONNECT.UNEXPECTED RECON.GPG SUBTERFUGE.LASTLOG LD.LINUX.EXEC LD.SO.PRELOAD USERFAULTFD.HANDLER RECON.LINPEAS PROOT.EXEC) proc.sid=1 proc.exepath=/usr/sbin/userdel user.uid=0 user.loginuid=-1 user.loginname=<NA> user.name=root group.gid=0 group.name=root container.id=6949e5f10829 container.name=threatgen image=docker.io/dockerbadboy/art)",
    "orchestrator": {
        "cluster": {
            "name": "gke-alliances-demo-6"
        },
        "namespace": "default",
        "resource": {
            "name": "threatgen-c65cf6446-5s8kk",
            "parent": {
                "type": "deployment"
            }
        },
        "type": "kubernetes"
    },
    "rule": {
        "author": [
            "Sysdig"
        ],
        "category": "RULE_TYPE_FALCO",
        "name": "User Management Event Detected",
        "ruleset": "Sysdig Runtime Activity Logs",
        "version": "35"
    },
    "sysdig": {
        "agentId": 58014837,
        "category": "runtime",
        "containerId": "6949e5f10829",
        "content": {
            "fields": {
                "container.name": "threatgen",
                "proc.cmdline": "userdel tmp_suid_user",
                "proc.cwd": "/tmp/",
                "proc.exepath": "/usr/sbin/userdel",
                "proc.name": "userdel",
                "proc.pcmdline": "pwsh -c (./RunTests.ps1 STDIN.NETWORK DEV.SHM.EXEC T1048 RECON.FIND.SUID T1611.002 CONTAINER.ESCAPE.NSENTER CREDS.DUMP.MEMORY KILL.MALICIOUS.PROC LOAD.BPF.PROG Base64.PYTHON BASE64.CLI CONNECT.UNEXPECTED RECON.GPG SUBTERFUGE.LASTLOG LD.LINUX.EXEC LD.SO.PRELOAD USERFAULTFD.HANDLER RECON.LINPEAS PROOT.EXEC)",
                "proc.pid": "2140169",
                "proc.pname": "pwsh",
                "proc.ppid": "2140088",
                "user.name": "root",
                "user.uid": "0"
            },
            "output": "Users management command userdel tmp_suid_user launched by pwsh on threatgen under user root (proc.name=userdel proc.args=tmp_suid_user fd.name=<NA> proc.cmdline=pwsh -c (./RunTests.ps1 STDIN.NETWORK DEV.SHM.EXEC T1048 RECON.FIND.SUID T1611.002 CONTAINER.ESCAPE.NSENTER CREDS.DUMP.MEMORY KILL.MALICIOUS.PROC LOAD.BPF.PROG Base64.PYTHON BASE64.CLI CONNECT.UNEXPECTED RECON.GPG SUBTERFUGE.LASTLOG LD.LINUX.EXEC LD.SO.PRELOAD USERFAULTFD.HANDLER RECON.LINPEAS PROOT.EXEC) proc.pname=pwsh gparent=containerd-shim ggparent=<NA> gggparent=<NA> container=container_id=6949e5f10829 container_name=threatgen evt.type=execve evt.arg.request=<NA> proc.pid=2140169 proc.cwd=/tmp/ proc.ppid=2140088 proc.pcmdline=pwsh -c (./RunTests.ps1 STDIN.NETWORK DEV.SHM.EXEC T1048 RECON.FIND.SUID T1611.002 CONTAINER.ESCAPE.NSENTER CREDS.DUMP.MEMORY KILL.MALICIOUS.PROC LOAD.BPF.PROG Base64.PYTHON BASE64.CLI CONNECT.UNEXPECTED RECON.GPG SUBTERFUGE.LASTLOG LD.LINUX.EXEC LD.SO.PRELOAD USERFAULTFD.HANDLER RECON.LINPEAS PROOT.EXEC) proc.sid=1 proc.exepath=/usr/sbin/userdel user.uid=0 user.loginuid=-1 user.loginname=<NA> user.name=root group.gid=0 group.name=root container.id=6949e5f10829 container.name=threatgen image=docker.io/dockerbadboy/art)",
            "policyOrigin": "Sysdig",
            "policyVersion": 35,
            "ruleName": "User Management Event Detected",
            "ruleTags": [
                "host",
                "container",
                "MITRE",
                "MITRE_TA0003_persistence",
                "MITRE_T1136_create_account",
                "MITRE_T1136.001_create_account_local_account",
                "MITRE_T1070_indicator_removal",
                "MITRE_TA0005_defense_evasion",
                "MITRE_TA0040_impact",
                "MITRE_T1531_account_access_removal",
                "MITRE_T1098_account_manipulation"
            ],
            "ruleType": "RULE_TYPE_FALCO"
        },
        "description": "This policy contains rules which provide a greater insight into general activities occuring on the system. They are very noisy, but useful in threat hunting situations if you are looking for specific actions being taken during runtime. It is not recommended to use this policy for detection purposes unless tuning is enabled.  Additional manual tuning will likely be required.",
        "event": {
            "category": "runtime",
            "description": "This policy contains rules which provide a greater insight into general activities occuring on the system. They are very noisy, but useful in threat hunting situations if you are looking for specific actions being taken during runtime. It is not recommended to use this policy for detection purposes unless tuning is enabled.  Additional manual tuning will likely be required.",
            "type": "policy"
        },
        "hostMac": "42:01:0a:80:00:05",
        "id": "17dec715376910362c8c3f62a4ceda2e",
        "labels": {
            "cloudProvider": {
                "account": {
                    "id": "289645096542"
                },
                "name": "gcp",
                "region": "us-central1"
            },
            "gcp": {
                "availabilityZone": "us-central1-c",
                "instanceId": "648229130641697246",
                "instanceName": "gke-cluster-gcp-demo-san-default-pool-66250c41-vd1o",
                "machineType": "e2-standard-4",
                "projectId": "289645096542",
                "projectName": "alliances-chronicle"
            },
            "host": {
                "hostName": "gke-cluster-gcp-demo-san-default-pool-66250c41-vd1o"
            },
            "kubernetes": {
                "cluster": {
                    "name": "gke-alliances-demo-6"
                },
                "namespace": {
                    "name": "default"
                },
                "pod": {
                    "name": "threatgen-c65cf6446-5s8kk"
                },
                "workload": {
                    "type": "deployment"
                }
            }
        },
        "machineId": "42:01:0a:80:00:05",
        "name": "Sysdig Runtime Activity Logs",
        "originator": "policy",
        "severity": 7,
        "source": "syscall",
        "timestamp": 1720031001639981000,
        "timestampRFC3339Nano": "2024-07-03T18:23:21.63998111Z",
        "type": "policy"
    },
    "tags": [
        "host",
        "container",
        "MITRE",
        "MITRE_TA0003_persistence",
        "MITRE_T1136_create_account",
        "MITRE_T1136.001_create_account_local_account",
        "MITRE_T1070_indicator_removal",
        "MITRE_TA0005_defense_evasion",
        "MITRE_TA0040_impact",
        "MITRE_T1531_account_access_removal",
        "MITRE_T1098_account_manipulation"
    ],
    "threat.technique.id": [
        "T1136"
    ]
}