diff --git a/examples/tracingpolicy/lsm_track_grandparent.yml b/examples/tracingpolicy/lsm_track_grandparent.yml
new file mode 100644
index 00000000000..3ec64054677
--- /dev/null
+++ b/examples/tracingpolicy/lsm_track_grandparent.yml
@@ -0,0 +1,14 @@
+apiVersion: cilium.io/v1alpha1
+kind: TracingPolicy
+metadata:
+  name: "lsm"
+spec:
+  lsmhooks:
+  - hook: "bprm_check_security"
+    args:
+      - index: 0
+        type: "string"
+        resolve: "mm.owner.real_parent.real_parent.comm"
+    selectors:
+      - matchActions:
+        - action: Post