Container Security with Falco and Kubernetes
Educational demo of the Falcon CNCF simulator: it simulates a run-time alert on five Kubernetes scenarios (K8s). Privilege escalation, shell in container, crypto miner and other attack patterns with rules from Falcon, mapped to MITRE ATT&CK and remediations.
14:22:31.847192 Warning Container privilege escalation
(user=root user_uid=0 parent=sudo command=sudo /bin/sh
container_id=a1b2c3d4e5f6 container_name=webapp
image=nginx:1.25 proc.name=sudo proc.pid=3142
evt.type=setuid gparent=bash ggparent=sshd
aname[3]=systemd k8s.ns=production k8s.pod=webapp-7d9f8b-xkp2r)Rule explanation
Falco intercepts raw Linux syscalls via eBPF (or the kernel module) using the sysdig driver. When a process inside a container calls setuid(0) - escalating to root - and that process is not in the known allow-list (known_setuid_binaries), Falco fires this rule at CRITICAL priority. This pattern is a leading indicator of container breakout attempts: an attacker with an unprivileged shell exploit first escalates privileges inside the container before attempting to escape to the host namespace via CAP_SYS_ADMIN or /proc/1/ns/mnt.
What is Falco?
Falco is the open-source runtime security project of CNCF (Cloud Native Computing Foundation), founded by Loris Degioanni and originally created at Sysdig in 2016. It uses either eBPF or a traditional kernel module to intercept Linux syscalls at the kernel level, apply real-time rules, and generate structured alerts on anomalous behavior within containers and Kubernetes.
Unlike vulnerability scanning tools that analyze static images, Falco operates at runtime: it can detect unknown attack techniques (0-days) as long as they exhibit abnormal syscalls patterns. It is complementary to Trivy, OPA/Gateway and Pod Security Admission.
Come utilizzare Falco Container Security Demo
Choose an attack scenario
Select one of five simulated scenarios: privilege escalation, running a shell inside a container, reading sensitive files, cryptocurrency mining, or unexpected outgoing connection.
Read the Falcon Alert
In the "Alert Output" tab, you'll find the alert structured as Falco would generate it: timestamp, severity, container context and alerted syscall.
Study the Falcon YAML rule and MITRE ATT&CK mapping
Pass to the tab "Falcon Rule YAML" to see the snippet of the rule that detects behavior, with the tactic/technique MITRE ATT&CK associated.
Review Remediation and Best Practices
In the tabs "Remediation" and "Best Practices", find concrete steps to respond to the incident and CIS Kubernetes Benchmark guidelines to prevent it in the future.
Suggerimenti
- Start from the "Privilege Escalation" scenario: and is the most illustrative to understand how Falcon intercepts a critical system call at kernel level in real-time.
- Use the "Falcon Rule YAML" tab as a starting point to write your custom rules when installing Falcon on a real cluster.
- Compare "Remediation steps" with "Best Practices" to understand the difference between response to an existing incident and structural prevention (CIS Kubernetes Benchmark).
Domande frequenti
What is Falcon and what's its purpose?
Falcon is the open-source runtime security project of CNCF, created originally by Sysdig in 2016. Uses eBPF (or kernel module) to intercept Linux syscalls at kernel level and generate real-time alerts on anomalous behavior in containers and Kubernetes, unlike vulnerability scanners that only analyze static images.
Is this demo sending real data to a Kubernetes cluster?
No, it's a 100% client-side educational demo: alerts, YAML rules, and MITRE ATT&CK mappings are pre-calculated for the 5 scenarios, shown to understand how Falco works without needing a real Kubernetes cluster or installing anything.
What do the 5 available scenarios represent?
Common attack techniques in containers: privilege escalation (uid 1000 becomes uid 0 via syscall setuid), unexpected shell inside a running pod, reading sensitive files like /etc/shadow, outgoing connections to known crypto miners, and unexpected network connections from a process.
How does Falco differ from tools like Trivy or OPA/Gatekeeper?
Static image analysis of containers by Trivy and vulnerability scanners happens before deployment. OPA/Gatekeeper applies policies during cluster admission. Falco operates at runtime, detecting unknown attack techniques (zero-day) when system calls produce anomalous patterns while containers are running. They are complementary tools, not replacements.
How does each scenario connect to the MITRE ATT&CK framework?
Every scenario shows the MITRE ATT&CK tactics for Containers associated with detected behavior, so you can connect the Falco alert to an industry-recognized reference framework to classify attack techniques and align response to incidents with shared standards.