detecting-container-runtime-threats-with-falco

# Detecting Container Runtime Threats with Falco ## Overview Falco is the CNCF graduated runtime-security project (originally by Sysdig) that consumes Linux kernel syscalls and Kubernetes audit events through a driver, evaluates them against a YAML rule engine, and emits real-time alerts. It is the de facto open-source detection tool for runtime threats inside containers, including container escape (MITRE ATT&CK T1611, Escape to Host), namespace manipulation (`setns`), privileged mounts, reverse shells, and unexpected outbound connections. Falco supports three drivers: the **modern eBPF** probe (preferred default, requires kernel >= 5.8, shipped directly inside the Falco binary so no init container is needed), the legacy eBPF probe, and the kernel module (`kmod`). Driver selection is handled by `falcoctl driver config --type {kmod|ebpf|modern_ebpf}` or `driver.kind=modern_ebpf` in the Helm chart. On Kubernetes, Falco runs as a DaemonSet so every node is monitored, and `falcoctl` automatically installs and updates rule artifacts from the Falco rules registry. This skill covers authoring and deploying custom Falco rules to detect the container-escape primitives and anomalous-behavior signals that the breakout techniques in this collection produce. Each Falco rule has the fields `rule`, `desc`, `condition`, `output`, `priority`, and optional `tags`; reusable logic is factored into `macro` and `list` objects. Source: falco.org official documentation; falcosecurity/rules repository; Sysdig Falco detection research (e.g., CVE-2025-22224). ## When to Use - Building runtime detections for a Kubernetes or Docker environment - Validating that container-escape and lateral-movement attempts generate alerts (purple-team) - Adding coverage for a newly disclosed runtime CVE - Hardening a SOC's container telemetry pipeline (Falco -> Falcosidekick -> SIEM) ## Prerequisites - A Linux host (kernel >= 5.8 for modern eBPF) or Kubernetes cluster you administer - Falco install: ```bash # Helm (Kubernetes, modern eBPF, JSON output for SIEM ingest) helm repo add falcosecurity https://falcosecurity.github.io/charts helm repo update helm install falco falcosecurity/falco \ --namespace falco --create-namespace \ --set driver.kind=modern_ebpf \ --set collectors.containerd.enabled=true \ --set falco.json_output=true \ --set tty=true # Linux package install (Debian/Ubuntu) curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | \ sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg echo "deb [signed-by=/usr/share/keyrings/falco-archive-keyring.gpg] \ https://download.falco.org/packages/deb stable main" | \ sudo tee /etc/apt/sources.list.d/falcosecurity.list sudo apt-get update -y && sudo apt-get install -y falco ``` - Basic familiarity with Falco fields (`evt.type`, `proc.name`, `container.id`, `fd.name`) ## Objectives - Install Falco with the modern eBPF driver - Understand the rule/macro/list schema and key Falco filter fields - Author custom rules for container escape, `setns`, privileged mounts, sensitive-file reads, and reverse shells - Load custom rules and validate syntax - Trigger and confirm detections (purple-team validation) - Forward alerts to a SIEM via Falcosidekick ## MITRE ATT&CK Mapping | Technique ID | Name | Tactic | |--------------|------|--------| | T1611 | Escape to Host | Privilege Escalation | | T1059.004 | Command and Scripting Interpreter: Unix Shell | Execution | | T1610 | Deploy Container | Defense Evasion / Execution | | T1543 | Create or Modify System Process | Persistence | | T1071.001 | Application Layer Protocol: Web Protocols | Command and Control | ## Workflow ### Step 1: Install Falco and Confirm the Driver ```bash # Kubernetes: confirm the DaemonSet is running on every node kubectl get pods -n falco -o wide kubectl logs -n falco -l app.kubernetes.io/name=falco | grep -i "driver" # Linux host: configure driver and start sudo falcoctl driver config --type modern_ebpf sudo systemctl enable --now falco-modern-bpf.service sudo systemctl status falco-modern-bpf.service ``` ### Step 2: Learn the Rule, Macro, and List Schema Custom rules live in `/etc/falco/falco_rules.local.yaml` or `/etc/falco/rules.d/`, referenced from `rules_files` in `/etc/falco/falco.yaml`. ```yaml # /etc/falco/rules.d/custom-escape.yaml - list: shell_binaries items: [bash, sh, zsh, dash, ash, ksh] - macro: spawned_process condition: evt.type in (execve, execveat) and evt.dir = < - macro: container condition: container.id != host ``` ### Step 3: Write a Container-Escape Detection Rule (release_agent / cgroup) ```yaml - rule: Container Escape via cgroup release_agent desc: > Detect a process inside a container writing to a cgroup release_agent or notify_on_release file, a classic privileged-container breakout primitive. condition: > container and spawned_process and (evt.type in (open, openat, openat2) or evt.type=write) and (fd.name endswith "release_agent" or fd.name endswith "notify_on_release") and evt.is_open_write=true output: > Container escape attempt via cgroup release_agent (user=%user.name command=%proc.cmdline file=%fd.name container=%container.name image=%container.image.repository) priority: CRITICAL tags: [container, mitre_privilege_escalation, T1611] ``` ### Step 4: Detect Namespace Breakout (setns / nsenter) ```yaml - rule: Namespace Change via setns to Host desc: > Detect setns/nsenter used to enter the host namespace (e.g. nsenter -t 1), a common container-to-host escape technique. condition: > evt.type = setns and container and proc.name in (nsenter, unshare) output: > Namespace breakout via setns/nsenter (user=%user.name proc=%proc.name cmd=%proc.cmdline container=%container.name image=%container.image.repository) priority: CRITICAL tags: [container, mitre_privilege_escalation, T1611] ``` ### Step 5: Detect Privileged Mount and Docker Socket Abuse ```yaml - rule: Mount Launched in Privileged Container desc: Detect the mount binary running inside a privileged container. condition: > spawned_process and container and container.privileged = true and proc.name = mount output: > Mount executed in privileged container (cmd=%proc.cmdline container=%container.name image=%container.image.repository) priority: WARNING tags: [container, mitre_privilege_escalation, T1611] - rule: Docker Socket Accessed From Container desc: A container process reads/writes the host Docker daemon socket. condition: > container and (evt.type in (open, openat, openat2, connect)) and fd.name = /var/run/docker.sock output: > Container touched docker.sock - possible daemon-API escape (proc=%proc.name cmd=%proc.cmdline container=%container.name) priority: CRITICAL tags: [container, mitre_execution, T1610] ``` ### Step 6: Detect Reverse Shells and Sensitive File Reads ```yaml - rule: Reverse Shell From Container desc: A shell in a container with stdin/stdout wired to a network socket. condition: > spawned_process and container and proc.name in (shell_binaries) and (fd.num in (0, 1, 2)) and fd.type in (ipv4, ipv6) output: > Reverse shell detected in container (proc=%proc.cmdline connection=%fd.name container=%container.name) priority: CRITICAL tags: [container, mitre_execution, T1059.004] - rule: Read Sensitive Host File From Container desc: Container reads /etc/shadow or similar after a likely escape. condition: > container and (evt.type in (open, openat, openat2)) and evt.is_open_read=true and fd.name in (/etc/shadow, /etc/sudoers, /root/.ssh/id_rsa) output: > Sensitive file read from container (file=%fd.name proc=%proc.cmdline container=%container.name) priority: WARNING tags: [container, mitre_credential_access] ``` ### Step 7: Validate Rule Syntax and Load ```bash # Dry-run validate a rules file without starting the engine sudo falco --validate /etc/falco/rules.d/custom-escape.yaml # Run Falco with only the custom rules to test sudo falco -r /etc/falco/rules.d/custom-escape.yaml # Helm: ship custom rules via values (mounted into /etc/falco/rules.d) helm upgrade falco falcosecurity/falco -n falco --reuse-values \ --set-file "customRules.custom-escape\.yaml"=./custom-escape.yaml ``` ### Step 8: Trigger and Confirm (Purple-Team) ```bash # In a test container, trigger the setns rule kubectl run pwn --rm -it --image=alpine --overrides=' {"spec":{"hostPID":true,"containers":[{"name":"pwn","image":"alpine", "securityContext":{"privileged":true},"stdin":true,"tty":true, "command":["sh"]}]}}' -- sh -c 'nsenter -t 1 -m -u -i -n -p -- id' # Confirm the alert fired kubectl logs -n falco -l app.kubernetes.io/name=falco | grep -i "Namespace breakout" ``` ### Step 9: Forward Alerts to a SIEM ```bash # Deploy Falcosidekick to fan out alerts (Elastic, Slack, Splunk, etc.) helm upgrade falco falcosecurity/falco -n falco --reuse-values \ --set falcosidekick.enabled=true \ --set falcosidekick.config.elasticsearch.hostport=https://elastic:9200 \ --set falcosidekick.config.elasticsearch.index=falco ``` ## Tools and Resources | Tool | Purpose | Source | |------|---------|--------| | Falco | Runtime syscall detection engine | https://falco.org | | falcoctl | Driver + rules artifact manager | https://github.com/falcosecurity/falcoctl | | falcosecurity/rules | Maintained default ruleset | https://github.com/falcosecurity/rules | | Falcosidekick | Alert fan-out to SIEM/chat | https://github.com/falcosecurity/falcosidekick | | Falco Helm chart | Kubernetes DaemonSet deploy | https://github.com/falcosecurity/charts | ## Key Falco Filter Fields | Field | Meaning | |-------|---------| | `evt.type` | Syscall name (execve, setns, open, connect) | | `evt.dir` | Event direction (`<` exit, `>` enter) | | `proc.name` / `proc.cmdline` | Process name / full command line | | `container.id` / `container.privileged` | Container identity / privileged flag | | `container.image.repository` | Image name | | `fd.name` / `fd.type` | File/socket path / type (ipv4, ipv6) | | `evt.is_open_write` / `evt.is_open_read` | Open intent | | `user.name` | Acting user | ## Validation Criteria - [ ] Falco installed with the modern eBPF driver (DaemonSet on all nodes) - [ ] Custom rules file validated with `falco --validate` - [ ] release_agent / setns / privileged-mount / docker.sock rules loaded - [ ] Reverse-shell and sensitive-file-read rules loaded - [ ] Each rule triggered in a lab and the alert confirmed in logs - [ ] Priorities set appropriately (CRITICAL for escape primitives) - [ ] Alerts forwarded to the SIEM via Falcosidekick - [ ] Rule tags include the relevant MITRE technique IDs