Detecting Container Runtime Threats With Falco

# Kubernetes: confirm the DaemonSet is running on every node
kubectl get pods -n falco -o wide
kubectl logs -n falco -l app.kubernetes.io/name=falco | grep -i "driver"

# Linux host: configure driver and start
sudo falcoctl driver config --type modern_ebpf
sudo systemctl enable --now falco-modern-bpf.service
sudo systemctl status falco-modern-bpf.service

# /etc/falco/rules.d/custom-escape.yaml
- list: shell_binaries
  items: [bash, sh, zsh, dash, ash, ksh]

- macro: spawned_process
  condition: evt.type in (execve, execveat) and evt.dir = <

- macro: container
  condition: container.id != host

- rule: Container Escape via cgroup release_agent
  desc: >
    Detect a process inside a container writing to a cgroup release_agent or
    notify_on_release file, a classic privileged-container breakout primitive.
  condition: >
    container
    and spawned_process
    and (evt.type in (open, openat, openat2) or evt.type=write)
    and (fd.name endswith "release_agent"
         or fd.name endswith "notify_on_release")
    and evt.is_open_write=true
  output: >
    Container escape attempt via cgroup release_agent
    (user=%user.name command=%proc.cmdline file=%fd.name
     container=%container.name image=%container.image.repository)
  priority: CRITICAL
  tags: [container, mitre_privilege_escalation, T1611]

- rule: Namespace Change via setns to Host
  desc: >
    Detect setns/nsenter used to enter the host namespace (e.g. nsenter -t 1),
    a common container-to-host escape technique.
  condition: >
    evt.type = setns
    and container
    and proc.name in (nsenter, unshare)
  output: >
    Namespace breakout via setns/nsenter
    (user=%user.name proc=%proc.name cmd=%proc.cmdline
     container=%container.name image=%container.image.repository)
  priority: CRITICAL
  tags: [container, mitre_privilege_escalation, T1611]

- rule: Mount Launched in Privileged Container
  desc: Detect the mount binary running inside a privileged container.
  condition: >
    spawned_process
    and container
    and container.privileged = true
    and proc.name = mount
  output: >
    Mount executed in privileged container
    (cmd=%proc.cmdline container=%container.name image=%container.image.repository)
  priority: WARNING
  tags: [container, mitre_privilege_escalation, T1611]

- rule: Docker Socket Accessed From Container
  desc: A container process reads/writes the host Docker daemon socket.
  condition: >
    container
    and (evt.type in (open, openat, openat2, connect))
    and fd.name = /var/run/docker.sock
  output: >
    Container touched docker.sock - possible daemon-API escape
    (proc=%proc.name cmd=%proc.cmdline container=%container.name)
  priority: CRITICAL
  tags: [container, mitre_execution, T1610]

- rule: Reverse Shell From Container
  desc: A shell in a container with stdin/stdout wired to a network socket.
  condition: >
    spawned_process
    and container
    and proc.name in (shell_binaries)
    and (fd.num in (0, 1, 2))
    and fd.type in (ipv4, ipv6)
  output: >
    Reverse shell detected in container
    (proc=%proc.cmdline connection=%fd.name container=%container.name)
  priority: CRITICAL
  tags: [container, mitre_execution, T1059.004]

- rule: Read Sensitive Host File From Container
  desc: Container reads /etc/shadow or similar after a likely escape.
  condition: >
    container
    and (evt.type in (open, openat, openat2))
    and evt.is_open_read=true
    and fd.name in (/etc/shadow, /etc/sudoers, /root/.ssh/id_rsa)
  output: >
    Sensitive file read from container (file=%fd.name proc=%proc.cmdline
     container=%container.name)
  priority: WARNING
  tags: [container, mitre_credential_access]

# Dry-run validate a rules file without starting the engine
sudo falco --validate /etc/falco/rules.d/custom-escape.yaml

# Run Falco with only the custom rules to test
sudo falco -r /etc/falco/rules.d/custom-escape.yaml

# Helm: ship custom rules via values (mounted into /etc/falco/rules.d)
helm upgrade falco falcosecurity/falco -n falco --reuse-values \
  --set-file "customRules.custom-escape\.yaml"=./custom-escape.yaml

# In a test container, trigger the setns rule
kubectl run pwn --rm -it --image=alpine --overrides='
{"spec":{"hostPID":true,"containers":[{"name":"pwn","image":"alpine",
"securityContext":{"privileged":true},"stdin":true,"tty":true,
"command":["sh"]}]}}' -- sh -c 'nsenter -t 1 -m -u -i -n -p -- id'

# Confirm the alert fired
kubectl logs -n falco -l app.kubernetes.io/name=falco | grep -i "Namespace breakout"

# Deploy Falcosidekick to fan out alerts (Elastic, Slack, Splunk, etc.)
helm upgrade falco falcosecurity/falco -n falco --reuse-values \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.elasticsearch.hostport=https://elastic:9200 \
  --set falcosidekick.config.elasticsearch.index=falco