Detecting Container Runtime Threats with Falco

Overview

Falco is the CNCF graduated runtime-security project (originally by Sysdig) that consumes Linux kernel syscalls and Kubernetes audit events through a driver, evaluates them against a YAML rule engine, and emits real-time alerts. It is the de facto open-source detection tool for runtime threats inside containers, including container escape (MITRE ATT&CK T1611, Escape to Host), namespace manipulation (setns), privileged mounts, reverse shells, and unexpected outbound connections.

Falco supports three drivers: the modern eBPF probe (preferred default, requires kernel >= 5.8, shipped directly inside the Falco binary so no init container is needed), the legacy eBPF probe, and the kernel module (kmod). Driver selection is handled by falcoctl driver config --type {kmod|ebpf|modern_ebpf} or driver.kind=modern_ebpf in the Helm chart. On Kubernetes, Falco runs as a DaemonSet so every node is monitored, and falcoctl automatically installs and updates rule artifacts from the Falco rules registry.

This skill covers authoring and deploying custom Falco rules to detect the container-escape primitives and anomalous-behavior signals that the breakout techniques in this collection produce. Each Falco rule has the fields rule, desc, condition, output, priority, and optional tags; reusable logic is factored into macro and list objects. Source: falco.org official documentation; falcosecurity/rules repository; Sysdig Falco detection research (e.g., CVE-2025-22224).

When to Use

• Building runtime detections for a Kubernetes or Docker environment
• Validating that container-escape and lateral-movement attempts generate alerts (purple-team)
• Adding coverage for a newly disclosed runtime CVE
• Hardening a SOC's container telemetry pipeline (Falco -> Falcosidekick -> SIEM)

Prerequisites

• A Linux host (kernel >= 5.8 for modern eBPF) or Kubernetes cluster you administer
• Falco install:

  # Helm (Kubernetes, modern eBPF, JSON output for SIEM ingest)
  helm repo add falcosecurity https://falcosecurity.github.io/charts
  helm repo update
  helm install falco falcosecurity/falco \
    --namespace falco --create-namespace \
    --set driver.kind=modern_ebpf \
    --set collectors.containerd.enabled=true \
    --set falco.json_output=true \
    --set tty=true
  
  # Linux package install (Debian/Ubuntu)
  curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | \
    sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg
  echo "deb [signed-by=/usr/share/keyrings/falco-archive-keyring.gpg] \
    https://download.falco.org/packages/deb stable main" | \
    sudo tee /etc/apt/sources.list.d/falcosecurity.list
  sudo apt-get update -y && sudo apt-get install -y falco
  

• Basic familiarity with Falco fields (evt.type, proc.name, container.id, fd.name)

Objectives

• Install Falco with the modern eBPF driver
• Understand the rule/macro/list schema and key Falco filter fields
• Author custom rules for container escape, setns, privileged mounts, sensitive-file reads, and reverse shells
• Load custom rules and validate syntax
• Trigger and confirm detections (purple-team validation)
• Forward alerts to a SIEM via Falcosidekick

MITRE ATT&CK Mapping

Workflow

Step 1: Install Falco and Confirm the Driver

# Kubernetes: confirm the DaemonSet is running on every node
kubectl get pods -n falco -o wide
kubectl logs -n falco -l app.kubernetes.io/name=falco | grep -i "driver"

# Linux host: configure driver and start
sudo falcoctl driver config --type modern_ebpf
sudo systemctl enable --now falco-modern-bpf.service
sudo systemctl status falco-modern-bpf.service

Step 2: Learn the Rule, Macro, and List Schema

Custom rules live in /etc/falco/falco_rules.local.yaml or /etc/falco/rules.d/, referenced from rules_files in /etc/falco/falco.yaml.

# /etc/falco/rules.d/custom-escape.yaml
- list: shell_binaries
  items: [bash, sh, zsh, dash, ash, ksh]

- macro: spawned_process

…