apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: detect-sensitive-binary-execution
spec:
  kprobes:
    - call: "security_bprm_check"
      syscall: false

      selectors:
        - matchBinaries:
            - operator: In
              values:
                - /usr/bin/curl
                - /usr/bin/wget
                - /usr/bin/nc
                - /usr/bin/netcat
                - /usr/bin/nmap
                - /usr/bin/socat
                - /usr/bin/ssh
                - /usr/sbin/iptables
                - /usr/bin/apt
                - /usr/bin/apt-get

      args:
        - index: 0
          type: string

      return: true