Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.
Instrucciones de origen · Vista previa de solo lectura
name
detecting-container-runtime-threats-with-falco
description
Write and deploy Falco rules with the modern eBPF driver to detect container escape, namespace abuse, privileged mounts, and anomalous syscalls at runtime in Kubernetes and Docker.
Falco is the CNCF graduated runtime-security project (originally by Sysdig) that consumes Linux kernel syscalls and Kubernetes audit events through a driver, evaluates them against a YAML rule engine, and emits real-time alerts. It is the de facto open-source detection tool for runtime threats inside containers, including container escape (MITRE ATT&CK T1611, Escape to Host), namespace manipulation (setns), privileged mounts, reverse shells, and unexpected outbound connections.
Falco supports three drivers: the modern eBPF probe (preferred default, requires kernel >= 5.8, shipped directly inside the Falco binary so no init container is needed), the legacy eBPF probe, and the kernel module (kmod). Driver selection is handled by falcoctl driver config --type {kmod|ebpf|modern_ebpf} or driver.kind=modern_ebpf in the Helm chart. On Kubernetes, Falco runs as a DaemonSet so every node is monitored, and falcoctl automatically installs and updates rule artifacts from the Falco rules registry.
This skill covers authoring and deploying custom Falco rules to detect the container-escape primitives and anomalous-behavior signals that the breakout techniques in this collection produce. Each Falco rule has the fields rule, desc, condition, output, priority, and optional tags; reusable logic is factored into macro and list objects. Source: falco.org official documentation; falcosecurity/rules repository; Sysdig Falco detection research (e.g., CVE-2025-22224).
When to Use
Building runtime detections for a Kubernetes or Docker environment
Validating that container-escape and lateral-movement attempts generate alerts (purple-team)
Step 3: Write a Container-Escape Detection Rule (release_agent / cgroup)
-rule:ContainerEscapeviacgrouprelease_agentdesc:>
Detect a process inside a container writing to a cgroup release_agent or
notify_on_release file, a classic privileged-container breakout primitive.
condition:>
container
and spawned_process
and (evt.type in (open, openat, openat2) or evt.type=write)
and (fd.name endswith "release_agent"
or fd.name endswith "notify_on_release")
and evt.is_open_write=true
output:>
Container escape attempt via cgroup release_agent
(user=%user.name command=%proc.cmdline file=%fd.name
container=%container.name image=%container.image.repository)
priority:CRITICALtags: [container, mitre_privilege_escalation, T1611]
-rule:NamespaceChangeviasetnstoHostdesc:>
Detect setns/nsenter used to enter the host namespace (e.g. nsenter -t 1),
a common container-to-host escape technique.
condition:>
evt.type = setns
and container
and proc.name in (nsenter, unshare)
output:>
Namespace breakout via setns/nsenter
(user=%user.name proc=%proc.name cmd=%proc.cmdline
container=%container.name image=%container.image.repository)
priority:CRITICALtags: [container, mitre_privilege_escalation, T1611]
Step 5: Detect Privileged Mount and Docker Socket Abuse
-rule:MountLaunchedinPrivilegedContainerdesc:Detectthemountbinaryrunninginsideaprivilegedcontainer.condition:>
spawned_process
and container
and container.privileged = true
and proc.name = mount
output:>
Mount executed in privileged container
(cmd=%proc.cmdline container=%container.name image=%container.image.repository)
priority:WARNINGtags: [container, mitre_privilege_escalation, T1611]
-rule:DockerSocketAccessedFromContainerdesc:Acontainerprocessreads/writesthehostDockerdaemonsocket.condition:>
container
and (evt.type in (open, openat, openat2, connect))
and fd.name = /var/run/docker.sock
output:>
Container touched docker.sock - possible daemon-API escape
(proc=%proc.name cmd=%proc.cmdline container=%container.name)
priority:CRITICALtags: [container, mitre_execution, T1610]
Step 6: Detect Reverse Shells and Sensitive File Reads
-rule:ReverseShellFromContainerdesc:Ashellinacontainerwithstdin/stdoutwiredtoanetworksocket.condition:>
spawned_process
and container
and proc.name in (shell_binaries)
and (fd.num in (0, 1, 2))
and fd.type in (ipv4, ipv6)
output:>
Reverse shell detected in container
(proc=%proc.cmdline connection=%fd.name container=%container.name)
priority:CRITICALtags: [container, mitre_execution, T1059.004]
-rule:ReadSensitiveHostFileFromContainerdesc:Containerreads/etc/shadoworsimilarafteralikelyescape.condition:>
container
and (evt.type in (open, openat, openat2))
and evt.is_open_read=true
and fd.name in (/etc/shadow, /etc/sudoers, /root/.ssh/id_rsa)
output:>
Sensitive file read from container (file=%fd.name proc=%proc.cmdline
container=%container.name)
priority:WARNINGtags: [container, mitre_credential_access]
Step 7: Validate Rule Syntax and Load
# Dry-run validate a rules file without starting the enginesudo falco --validate /etc/falco/rules.d/custom-escape.yaml
# Run Falco with only the custom rules to testsudo falco -r /etc/falco/rules.d/custom-escape.yaml
# Helm: ship custom rules via values (mounted into /etc/falco/rules.d)
helm upgrade falco falcosecurity/falco -n falco --reuse-values \
--set-file "customRules.custom-escape\.yaml"=./custom-escape.yaml
Step 8: Trigger and Confirm (Purple-Team)
# In a test container, trigger the setns rule
kubectl run pwn --rm -it --image=alpine --overrides='
{"spec":{"hostPID":true,"containers":[{"name":"pwn","image":"alpine",
"securityContext":{"privileged":true},"stdin":true,"tty":true,
"command":["sh"]}]}}' -- sh -c 'nsenter -t 1 -m -u -i -n -p -- id'# Confirm the alert fired
kubectl logs -n falco -l app.kubernetes.io/name=falco | grep -i "Namespace breakout"
Step 9: Forward Alerts to a SIEM
# Deploy Falcosidekick to fan out alerts (Elastic, Slack, Splunk, etc.)
helm upgrade falco falcosecurity/falco -n falco --reuse-values \
--set falcosidekick.enabled=true \
--set falcosidekick.config.elasticsearch.hostport=https://elastic:9200 \
--set falcosidekick.config.elasticsearch.index=falco
