{"hostname":"97ade2b595f0","output":"2024-05-07T18:54:19.341081180+0000: Warning Sensitive file opened for reading by non-trusted program (file=/etc/shadow gparent=runc ggparent=init gggparent=init evt_type=openat user=root user_uid=0 user_loginuid=-1 process=event-generator proc_exepath=/bin/event-generator parent=containerd-shim command=event-generator run --loop terminal=0 container_id=9656db3bb358 container_name=elastic-package-service-falco-event-generator-1)","priority":"Warning","rule":"Read sensitive file untrusted","source":"syscall","tags":["T1555","container","filesystem","host","maturity_stable","mitre_credential_access"],"time":"2024-05-07T18:54:19.341081180Z", "output_fields": {"container.id":"9656db3bb358","container.name":"elastic-package-service-falco-event-generator-1","evt.time.iso8601":1715108059341081180,"evt.type":"openat","fd.name":"/etc/shadow","proc.cmdline":"event-generator run --loop","proc.exepath":"/bin/event-generator","proc.name":"event-generator","proc.pname":"containerd-shim","proc.tty":0,"user.loginuid":-1,"user.name":"root","user.uid":0}}