Perj's file integrity monitoring discovers critical files on each node and alerts on relevant changes. It reconstructs the process lineage and user identity behind each event, then returns an AI-investigated verdict with affected paths and supporting evidence.
Event chain
containerd-shim-runc-v2
Kubernetes container runtime process
EXECVE /bin/sh
Non-interactive root shell launched outside the normal process lineage
OPEN /root/.ssh/authorized_keys
SSH public key appended to a policy-significant asset
Root SSH Persistence
Root SSH Persistence
A runtime-launched root shell successfully appended an SSH key to root's authorized_keys in a Kubernetes container, establishing persistence through a policy-significant asset.
AI Findings
Verdict
Malicious
Confidence
98%
Reasoning
A root shell launched outside the container's normal process lineage created /root/.ssh and appended a public key to authorized_keys. The successful write modified a policy-significant asset and established persistence.
MITRE Techniques
Indicators