Falco

Falco is an open-source runtime monitoring tool for containerized deployments. It uses eBPF to observe system behavior, evaluates that behavior against rules, and emits alerts when activity matches a detected threat. In Kubernetes, it provides visibility into commands and network actions originating inside containers. section 5.1.3

Deploy Falco when existing telemetry cannot answer what ran inside a container, where it ran, or what it tried to reach. Run it as a DaemonSet, begin with the default ruleset, and treat deployment as a production security change that requires prior evaluation and testing. section 5.1.3

A Falco rule connects an observable runtime action to an investigation-ready alert:

• Set a rule name and description that identify the suspicious behavior, such as execution of a Kubernetes client inside a container. section 5.1.3
• Express conditions over process, container, event, file-descriptor, and Kubernetes context, while excluding known expected activity. section 5.1.3
• Output command, user, pod, image, and connection details so an alert identifies the affected workload and action. section 5.1.3
• Assign a priority and tags to classify the detection, such as container execution or Kubernetes discovery activity. section 5.1.3

rule: The docker client is executed in a container                  #1
desc: Detect a k8s client tool executed inside a container          #2
condition: spawned_process and container and                             \
   not user_known_k8s_client_container_parens and                        \
   proc.name in (k8s_client_binaries)                               #3
output: "Docker or kubernetes client executed in container               \
   (user=%user.name user_loginuid=%user.loginuid %container.info         \
   parent=%proc.pname cmdline=%proc.cmdline image=%container.image.       \
   repository:%container.image.tag)"                                #4
rule: The docker client is executed in a container                  #1
priority: WARNING                                                   #5
tags: [container, mitre_execution]                                  #6

This rule detects a Kubernetes or Docker client launched in a container, then reports the user, pod, command line, and image. Its condition-and-output structure is a template for writing focused runtime detections. section 5.1.3

Rules can also encode a specific threat hypothesis. For example, define a detection for uploads of .php files to /var/www/html/wp-content/uploads, then review its fields and outputs to ensure the resulting alert captures useful context. section 5.4