eBPF is a Linux kernel-based construct for extending kernel capabilities without recompiling the kernel or loading kernel modules. In Kubernetes environments, it supplies network and system visibility that ordinary node audit logs may lack, including commands executed inside containers. section 5.1.3
Use eBPF when an investigation must establish what happened in a container, where it happened, and who initiated it. Commands from a kubectl exec session can be recorded, logged as events, forwarded to a data store, and replayed as an ordered session. section 5.1.3
A practical deployment and detection workflow is:
- Evaluate and test new collection or detection tooling before production deployment. section 5.1.3
- Deploy an eBPF-backed runtime monitor such as Falco as a DaemonSet to capture unexpected container executions. section 5.1.3
- Write rules around suspicious process execution and network activity, then send the resulting events into the investigation. section 5.1.3
- Hand confirmed evidence to incident response and recommend eBPF visibility alongside API-call, unsafe-workload, and service-account-change monitoring. section 5.3.3
Detecting a Kubernetes client inside a container
A Falco rule can match a spawned process in a container whose process name is a Kubernetes client binary, excluding known client containers. Its alert records the user, container details, parent process, command line, and image. In the investigation, this exposed a kubectl command creating a deployment from inside a portal container; a companion rule then reported that container contacting the Kubernetes API server. section 5.1.3
Listing 5.18 Executing Kubernetes client in a container rule
rule: The docker client is executed in a container #1 desc: Detect a k8s client tool executed inside a container #2 condition: spawned_process and container and \ not user_known_k8s_client_container_parens and \ proc.name in (k8s_client_binaries) #3 output: "Docker or kubernetes client executed in container \ (user=%user.name user_loginuid=%user.loginuid %container.info \ parent=%proc.pname cmdline=%proc.cmdline image=%container.image. \ repository:%container.image.tag)" #4 rule: The docker client is executed in a container #1 priority: WARNING #5 tags: [container, mitre_execution] #6
Inspect the rule structure: a named rule combines process, container, allowlist, and binary conditions, then emits investigation-ready context and tags. section 5.1.3
Falco uses eBPF to provide Kubernetes security visibility and detection. Reviewing its rules and supported fields supports writing a rule for a concrete file-upload condition, such as detecting a .php file uploaded to a WordPress uploads directory. section 5.4
