Use Tetragon to detect privilege escalation by monitoring kernel credential change functions with a TracingPolicy kprobe

Steps

1. Create a TracingPolicy with a kprobe on the commit_creds kernel function, which is called whenever a process's credentials are updated
2. Declare the cred struct as the first argument so Tetragon can extract UID, GID, and capability fields from the new credentials
3. Add a matchArgs or matchCaps selector that triggers when the new UID equals 0 or when capabilities such as CAP_SYS_ADMIN are gained
4. Optionally add matchBinaries to flag only unexpected binaries performing the privilege change
5. Apply the policy and simulate a privilege escalation (e.g., via a setuid binary in a test container); confirm Tetragon emits a process_kprobe event
6. Forward events to a SIEM via tetra getevents --output json for correlation and alerting