[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEB8S2HGS4BM0H1KBM3ESF":3,"skill-same:01M6AEB8S2HGS4BM0H1KBM3ESF":131},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":68,"commitSha":69,"skillDirectory":70,"forksCount":71,"repositoryHtmlUrl":72,"repositoryHomepageUrl":73,"ownerHtmlUrl":74,"ownerBlogUrl":75,"ownerDescription":76,"updatedAt":77,"install":78,"resources":91},"01M6AEB8S2HGS4BM0H1KBM3ESF","detecting-container-escape-with-falco-rules",null,"Writes and tunes Falco rule syntax for container escape detection - conditions, macros, lists, priorities, and output fields - covering host filesystem mounts, sensitive host path access, kernel module loading, and privileged capability abuse, including how to drive down false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour, or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list, condition, priority, falco_rules.local.yaml, tuning, false positive. Do not use for deploying and operating Falco itself - use detecting-container-runtime-threats-with-falco; for tool-agnostic escape signals use detecting-container-escape-attempts.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"detecting container escape with falco rules","falco","yaml","syscall-monitoring","container-escape","runtime-security","detection","macro","container-security","monitoring","kernel","file","metadata","protocol","validation","pr","cybersecurity","security","kubernetes","2026-11-10 10:12:30",false,"---\nname: detecting-container-escape-with-falco-rules\ndescription: >-\n  Writes and tunes Falco rule syntax for container escape detection - conditions, macros,\n  lists, priorities, and output fields - covering host filesystem mounts, sensitive host path\n  access, kernel module loading, and privileged capability abuse, including how to drive down\n  false positives. Use when authoring or tuning a specific Falco rule for breakout behaviour,\n  or triaging a noisy escape-related Falco alert. Keywords: Falco rule, macro, list,\n  condition, priority, falco_rules.local.yaml, tuning, false positive. Do not use for\n  deploying and operating Falco itself - use detecting-container-runtime-threats-with-falco;\n  for tool-agnostic escape signals use detecting-container-escape-attempts.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- falco\n- container-escape\n- runtime-security\n- syscall-monitoring\n- kubernetes\n- detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nd3fend_techniques:\n- Token Binding\n- Execution Isolation\n- File Metadata Consistency Validation\n- Restore Access\n- Application Protocol Command Analysis\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmitre_attack:\n- T1610\n- T1611\n- T1609\n- T1525\n- T1068\n---\n\n# Detecting Container Escape with Falco Rules\n\n## Overview\n\nFalco is a CNCF-graduated runtime security tool that monitors Linux syscalls to detect anomalous container behavior. It uses a rules engine to identify container escape techniques such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting container escape with falco rules\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Linux host with kernel 5.8+ (for eBPF driver) or kernel module support\n- Kubernetes cluster (v1.24+) or standalone Docker\u002Fcontainerd\n- Helm 3 for Kubernetes deployment\n- Root or privileged access for driver installation\n\n## Installing Falco\n\n### Kubernetes Deployment with Helm\n\n```bash\n# Add Falco Helm chart\nhelm repo add falcosecurity https:\u002F\u002Ffalcosecurity.github.io\u002Fcharts\nhelm repo update\n\n# Install Falco with eBPF driver\nhelm install falco falcosecurity\u002Ffalco \\\n  --namespace falco --create-namespace \\\n  --set falcosidekick.enabled=true \\\n  --set falcosidekick.webui.enabled=true \\\n  --set driver.kind=ebpf \\\n  --set collectors.containerd.enabled=true \\\n  --set collectors.containerd.socket=\u002Frun\u002Fcontainerd\u002Fcontainerd.sock\n\n# Verify\nkubectl get pods -n falco\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco --tail=20\n```\n\n### Standalone Installation (Debian\u002FUbuntu)\n\n```bash\n# Add Falco GPG key and repo\ncurl -fsSL https:\u002F\u002Ffalco.org\u002Frepo\u002Ffalcosecurity-packages.asc | \\\n  sudo gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg\n\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg] https:\u002F\u002Fdownload.falco.org\u002Fpackages\u002Fdeb stable main\" | \\\n  sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ffalcosecurity.list\n\nsudo apt-get update\nsudo apt-get install -y falco\n\n# Start Falco\nsudo systemctl enable falco\nsudo systemctl start falco\n```\n\n## Container Escape Detection Rules\n\n### Rule 1: Detect Host Mount from Container\n\n```yaml\n- rule: Container Mounting Host Filesystem\n  desc: Detect a container attempting to mount the host filesystem\n  condition: >\n    spawned_process and container and\n    proc.name = mount and\n    (proc.args contains \"\u002Fhost\" or proc.args contains \"nsenter\")\n  output: >\n    Container mounting host filesystem\n    (user=%user.name container_id=%container.id container_name=%container.name\n     image=%container.image.repository command=%proc.cmdline %evt.args)\n  priority: CRITICAL\n  tags: [container, escape, T1611]\n```\n\n### Rule 2: Detect nsenter Usage (Namespace Escape)\n\n```yaml\n- rule: Nsenter Execution in Container\n  desc: Detect nsenter being used to escape container namespaces\n  condition: >\n    spawned_process and container and proc.name = nsenter\n  output: >\n    nsenter executed in container - potential escape attempt\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname)\n  priority: CRITICAL\n  tags: [container, escape, namespace, T1611]\n```\n\n### Rule 3: Detect Privileged Container Launch\n\n```yaml\n- rule: Launch Privileged Container\n  desc: Detect a privileged container being launched\n  condition: >\n    container_started and container and container.privileged=true\n  output: >\n    Privileged container started\n    (user=%user.name container_id=%container.id container_name=%container.name\n     image=%container.image.repository)\n  priority: WARNING\n  tags: [container, privileged, T1610]\n```\n\n### Rule 4: Detect \u002Fproc\u002Fsysrq-trigger Write\n\n```yaml\n- rule: Write to Sysrq Trigger\n  desc: Detect writes to \u002Fproc\u002Fsysrq-trigger which can crash or control the host\n  condition: >\n    open_write and container and fd.name = \u002Fproc\u002Fsysrq-trigger\n  output: >\n    Write to \u002Fproc\u002Fsysrq-trigger from container\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, host-manipulation]\n```\n\n### Rule 5: Detect Kernel Module Loading from Container\n\n```yaml\n- rule: Container Loading Kernel Module\n  desc: Detect a container attempting to load a kernel module\n  condition: >\n    spawned_process and container and\n    (proc.name in (insmod, modprobe) or\n     (proc.name = init_module))\n  output: >\n    Kernel module loading from container\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, kernel, T1611]\n```\n\n### Rule 6: Detect Container Breakout via cgroups\n\n```yaml\n- rule: Write to Cgroup Release Agent\n  desc: Detect writes to cgroup release_agent which is a known container escape vector\n  condition: >\n    open_write and container and\n    fd.name endswith release_agent\n  output: >\n    Container writing to cgroup release_agent - escape attempt\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     file=%fd.name command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, cgroup, CVE-2022-0492]\n```\n\n### Rule 7: Detect Access to Host \u002Fetc\u002Fshadow\n\n```yaml\n- rule: Container Reading Host Shadow File\n  desc: Detect a container reading \u002Fetc\u002Fshadow on the host via mounted volume\n  condition: >\n    open_read and container and\n    (fd.name = \u002Fetc\u002Fshadow or fd.name startswith \u002Fhost\u002Fetc\u002Fshadow)\n  output: >\n    Container reading host shadow file\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     file=%fd.name command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, credential-access, T1003]\n```\n\n### Rule 8: Detect Docker Socket Access\n\n```yaml\n- rule: Container Accessing Docker Socket\n  desc: Detect a container accessing the Docker socket which allows host control\n  condition: >\n    (open_read or open_write) and container and\n    fd.name = \u002Fvar\u002Frun\u002Fdocker.sock\n  output: >\n    Container accessing Docker socket\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, docker-socket, T1610]\n```\n\n## Complete Custom Rules File\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer-escape.yaml\n- list: escape_binaries\n  items: [nsenter, chroot, unshare, mount, umount, pivot_root]\n\n- macro: container_escape_attempt\n  condition: >\n    spawned_process and container and\n    proc.name in (escape_binaries)\n\n- rule: Container Escape Binary Execution\n  desc: Detect execution of binaries commonly used for container escape\n  condition: container_escape_attempt\n  output: >\n    Escape-related binary executed in container\n    (user=%user.name container=%container.name image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname pid=%proc.pid)\n  priority: CRITICAL\n  tags: [container, escape, mitre_T1611]\n\n- rule: Sensitive File Access from Container\n  desc: Detect container access to sensitive host files\n  condition: >\n    (open_read or open_write) and container and\n    (fd.name startswith \u002Fproc\u002F1\u002F or\n     fd.name = \u002Fetc\u002Fshadow or\n     fd.name = \u002Fetc\u002Fkubernetes\u002Fadmin.conf or\n     fd.name startswith \u002Fvar\u002Flib\u002Fkubelet\u002F)\n  output: >\n    Sensitive file accessed from container\n    (container=%container.name image=%container.image.repository\n     file=%fd.name command=%proc.cmdline user=%user.name)\n  priority: CRITICAL\n  tags: [container, sensitive-file, mitre_T1005]\n```\n\n## Falco Configuration\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Ffalco.yaml (key settings)\nrules_files:\n  - \u002Fetc\u002Ffalco\u002Ffalco_rules.yaml\n  - \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer-escape.yaml\n\njson_output: true\njson_include_output_property: true\njson_include_tags_property: true\n\nlog_stderr: true\nlog_syslog: true\nlog_level: info\n\npriority: WARNING\n\nstdout_output:\n  enabled: true\n\nsyslog_output:\n  enabled: true\n\nhttp_output:\n  enabled: true\n  url: http:\u002F\u002Ffalcosidekick:2801\n  insecure: true\n\ngrpc:\n  enabled: true\n  bind_address: \"unix:\u002F\u002F\u002Frun\u002Ffalco\u002Ffalco.sock\"\n  threadiness: 8\n\ngrpc_output:\n  enabled: true\n```\n\n## Alert Integration\n\n### Forward to Slack via Falcosidekick\n\n```yaml\n# Falcosidekick values.yaml\nconfig:\n  slack:\n    webhookurl: \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FXXXXX\"\n    minimumpriority: \"warning\"\n    messageformat: |\n      *{{.Priority}}* - {{.Rule}}\n      Container: {{.OutputFields.container_name}}\n      Image: {{.OutputFields.container_image_repository}}\n      Command: {{.OutputFields.proc_cmdline}}\n```\n\n## Testing Rules\n\n```bash\n# Simulate container escape attempt (in a test container)\nkubectl run test-escape --image=alpine --restart=Never -- sh -c \"cat \u002Fetc\u002Fshadow\"\n\n# Simulate nsenter\nkubectl run test-nsenter --image=alpine --restart=Never --overrides='{\"spec\":{\"hostPID\":true}}' -- nsenter -t 1 -m -u -i -n -- cat \u002Fetc\u002Fhostname\n\n# Check Falco alerts\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco --tail=50 | grep -i escape\n```\n\n## Best Practices\n\n1. **Deploy Falco as DaemonSet** to ensure coverage on all nodes\n2. **Use eBPF driver** over kernel module for safer operation\n3. **Start with default rules** (maturity_stable) then add custom rules\n4. **Forward alerts** to SIEM\u002FSOAR via Falcosidekick\n5. **Tag rules with MITRE ATT&CK** technique IDs for correlation\n6. **Test rules** in permissive mode before enforcing\n7. **Tune false positives** by adding exception lists for known good processes\n8. **Monitor Falco health** with Prometheus metrics endpoint\n","# Detecting Container Escape with Falco Rules\n\n## Overview\n\nFalco is a CNCF-graduated runtime security tool that monitors Linux syscalls to detect anomalous container behavior. It uses a rules engine to identify container escape techniques such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting container escape with falco rules\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Linux host with kernel 5.8+ (for eBPF driver) or kernel module support\n- Kubernetes cluster (v1.24+) or standalone Docker\u002Fcontainerd\n- Helm 3 for Kubernetes deployment\n- Root or privileged access for driver installation\n\n## Installing Falco\n\n### Kubernetes Deployment with Helm\n\n```bash\n# Add Falco Helm chart\nhelm repo add falcosecurity https:\u002F\u002Ffalcosecurity.github.io\u002Fcharts\nhelm repo update\n\n# Install Falco with eBPF driver\nhelm install falco falcosecurity\u002Ffalco \\\n  --namespace falco --create-namespace \\\n  --set falcosidekick.enabled=true \\\n  --set falcosidekick.webui.enabled=true \\\n  --set driver.kind=ebpf \\\n  --set collectors.containerd.enabled=true \\\n  --set collectors.containerd.socket=\u002Frun\u002Fcontainerd\u002Fcontainerd.sock\n\n# Verify\nkubectl get pods -n falco\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco --tail=20\n```\n\n### Standalone Installation (Debian\u002FUbuntu)\n\n```bash\n# Add Falco GPG key and repo\ncurl -fsSL https:\u002F\u002Ffalco.org\u002Frepo\u002Ffalcosecurity-packages.asc | \\\n  sudo gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg\n\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg] https:\u002F\u002Fdownload.falco.org\u002Fpackages\u002Fdeb stable main\" | \\\n  sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ffalcosecurity.list\n\nsudo apt-get update\nsudo apt-get install -y falco\n\n# Start Falco\nsudo systemctl enable falco\nsudo systemctl start falco\n```\n\n## Container Escape Detection Rules\n\n### Rule 1: Detect Host Mount from Container\n\n```yaml\n- rule: Container Mounting Host Filesystem\n  desc: Detect a container attempting to mount the host filesystem\n  condition: >\n    spawned_process and container and\n    proc.name = mount and\n    (proc.args contains \"\u002Fhost\" or proc.args contains \"nsenter\")\n  output: >\n    Container mounting host filesystem\n    (user=%user.name container_id=%container.id container_name=%container.name\n     image=%container.image.repository command=%proc.cmdline %evt.args)\n  priority: CRITICAL\n  tags: [container, escape, T1611]\n```\n\n### Rule 2: Detect nsenter Usage (Namespace Escape)\n\n```yaml\n- rule: Nsenter Execution in Container\n  desc: Detect nsenter being used to escape container namespaces\n  condition: >\n    spawned_process and container and proc.name = nsenter\n  output: >\n    nsenter executed in container - potential escape attempt\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname)\n  priority: CRITICAL\n  tags: [container, escape, namespace, T1611]\n```\n\n### Rule 3: Detect Privileged Container Launch\n\n```yaml\n- rule: Launch Privileged Container\n  desc: Detect a privileged container being launched\n  condition: >\n    container_started and container and container.privileged=true\n  output: >\n    Privileged container started\n    (user=%user.name container_id=%container.id container_name=%container.name\n     image=%container.image.repository)\n  priority: WARNING\n  tags: [container, privileged, T1610]\n```\n\n### Rule 4: Detect \u002Fproc\u002Fsysrq-trigger Write\n\n```yaml\n- rule: Write to Sysrq Trigger\n  desc: Detect writes to \u002Fproc\u002Fsysrq-trigger which can crash or control the host\n  condition: >\n    open_write and container and fd.name = \u002Fproc\u002Fsysrq-trigger\n  output: >\n    Write to \u002Fproc\u002Fsysrq-trigger from container\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, host-manipulation]\n```\n\n### Rule 5: Detect Kernel Module Loading from Container\n\n```yaml\n- rule: Container Loading Kernel Module\n  desc: Detect a container attempting to load a kernel module\n  condition: >\n    spawned_process and container and\n    (proc.name in (insmod, modprobe) or\n     (proc.name = init_module))\n  output: >\n    Kernel module loading from container\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, kernel, T1611]\n```\n\n### Rule 6: Detect Container Breakout via cgroups\n\n```yaml\n- rule: Write to Cgroup Release Agent\n  desc: Detect writes to cgroup release_agent which is a known container escape vector\n  condition: >\n    open_write and container and\n    fd.name endswith release_agent\n  output: >\n    Container writing to cgroup release_agent - escape attempt\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     file=%fd.name command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, cgroup, CVE-2022-0492]\n```\n\n### Rule 7: Detect Access to Host \u002Fetc\u002Fshadow\n\n```yaml\n- rule: Container Reading Host Shadow File\n  desc: Detect a container reading \u002Fetc\u002Fshadow on the host via mounted volume\n  condition: >\n    open_read and container and\n    (fd.name = \u002Fetc\u002Fshadow or fd.name startswith \u002Fhost\u002Fetc\u002Fshadow)\n  output: >\n    Container reading host shadow file\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     file=%fd.name command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, credential-access, T1003]\n```\n\n### Rule 8: Detect Docker Socket Access\n\n```yaml\n- rule: Container Accessing Docker Socket\n  desc: Detect a container accessing the Docker socket which allows host control\n  condition: >\n    (open_read or open_write) and container and\n    fd.name = \u002Fvar\u002Frun\u002Fdocker.sock\n  output: >\n    Container accessing Docker socket\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, docker-socket, T1610]\n```\n\n## Complete Custom Rules File\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer-escape.yaml\n- list: escape_binaries\n  items: [nsenter, chroot, unshare, mount, umount, pivot_root]\n\n- macro: container_escape_attempt\n  condition: >\n    spawned_process and container and\n    proc.name in (escape_binaries)\n\n- rule: Container Escape Binary Execution\n  desc: Detect execution of binaries commonly used for container escape\n  condition: container_escape_attempt\n  output: >\n    Escape-related binary executed in container\n    (user=%user.name container=%container.name image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname pid=%proc.pid)\n  priority: CRITICAL\n  tags: [container, escape, mitre_T1611]\n\n- rule: Sensitive File Access from Container\n  desc: Detect container access to sensitive host files\n  condition: >\n    (open_read or open_write) and container and\n    (fd.name startswith \u002Fproc\u002F1\u002F or\n     fd.name = \u002Fetc\u002Fshadow or\n     fd.name = \u002Fetc\u002Fkubernetes\u002Fadmin.conf or\n     fd.name startswith \u002Fvar\u002Flib\u002Fkubelet\u002F)\n  output: >\n    Sensitive file accessed from container\n    (container=%container.name image=%container.image.repository\n     file=%fd.name command=%proc.cmdline user=%user.name)\n  priority: CRITICAL\n  tags: [container, sensitive-file, mitre_T1005]\n```\n\n## Falco Configuration\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Ffalco.yaml (key settings)\nrules_files:\n  - \u002Fetc\u002Ffalco\u002Ffalco_rules.yaml\n  - \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer-escape.yaml\n\njson_output: true\njson_include_output_property: true\njson_include_tags_property: true\n\nlog_stderr: true\nlog_syslog: true\nlog_level: info\n\npriority: WARNING\n\nstdout_output:\n  enabled: true\n\nsyslog_output:\n  enabled: true\n\nhttp_output:\n  enabled: true\n  url: http:\u002F\u002Ffalcosidekick:2801\n  insecure: true\n\ngrpc:\n  enabled: true\n  bind_address: \"unix:\u002F\u002F\u002Frun\u002Ffalco\u002Ffalco.sock\"\n  threadiness: 8\n\ngrpc_output:\n  enabled: true\n```\n\n## Alert Integration\n\n### Forward to Slack via Falcosidekick\n\n```yaml\n# Falcosidekick values.yaml\nconfig:\n  slack:\n    webhookurl: \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FXXXXX\"\n    minimumpriority: \"warning\"\n    messageformat: |\n      *{{.Priority}}* - {{.Rule}}\n      Container: {{.OutputFields.container_name}}\n      Image: {{.OutputFields.container_image_repository}}\n      Command: {{.OutputFields.proc_cmdline}}\n```\n\n## Testing Rules\n\n```bash\n# Simulate container escape attempt (in a test container)\nkubectl run test-escape --image=alpine --restart=Never -- sh -c \"cat \u002Fetc\u002Fshadow\"\n\n# Simulate nsenter\nkubectl run test-nsenter --image=alpine --restart=Never --overrides='{\"spec\":{\"hostPID\":true}}' -- nsenter -t 1 -m -u -i -n -- cat \u002Fetc\u002Fhostname\n\n# Check Falco alerts\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco --tail=50 | grep -i escape\n```\n\n## Best Practices\n\n1. **Deploy Falco as DaemonSet** to ensure coverage on all nodes\n2. **Use eBPF driver** over kernel module for safer operation\n3. **Start with default rules** (maturity_stable) then add custom rules\n4. **Forward alerts** to SIEM\u002FSOAR via Falcosidekick\n5. **Tag rules with MITRE ATT&CK** technique IDs for correlation\n6. **Test rules** in permissive mode before enforcing\n7. **Tune false positives** by adding exception lists for known good processes\n8. **Monitor Falco health** with Prometheus metrics endpoint\n",{"name":5,"tags":48,"author":49,"domain":40,"license":15,"version":50,"nist_csf":51,"subdomain":32,"description":7,"mitre_attack":56,"d3fend_techniques":62},[25,28,29,27,42,30],"mahipal","1.0",[52,53,54,55],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[57,58,59,60,61],"T1610","T1611","T1609","T1525","T1068",[63,64,65,66,67],"Token Binding","Execution Isolation","File Metadata Consistency Validation","Restore Access","Application Protocol Command Analysis","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-container-escape-with-falco-rules",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":79,"prompt":89,"zipAvailable":90},[80,83,86],{"tool":81,"command":82},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-container-escape-with-falco-rules",{"tool":84,"command":85},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-container-escape-with-falco-rules",{"tool":87,"command":88},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-container-escape-with-falco-rules","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002FSKILL.md",true,[92,98,104,109,113,117,121,127],{"path":93,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":96,"sourceHtmlUrl":97},"agents\u002Fopenai.yaml","REFERENCE","参考文档",137,"https:\u002F\u002Fgithub.com\u002FEvanston09\u002Fdotfiles\u002Fblob\u002Fmain\u002Fagents\u002Fgrill-me\u002Fagents\u002Fopenai.yaml",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"assets\u002Ftemplate.md","ASSET","资产文件",1904,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002Fassets\u002Ftemplate.md",{"path":105,"resourceType":105,"resourceTypeDesc":106,"sizeBytes":107,"sourceHtmlUrl":108},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002FLICENSE",{"path":110,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":111,"sourceHtmlUrl":112},"references\u002Fapi-reference.md",2387,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002Freferences\u002Fapi-reference.md",{"path":114,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":115,"sourceHtmlUrl":116},"references\u002Fstandards.md",2616,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002Freferences\u002Fstandards.md",{"path":118,"resourceType":94,"resourceTypeDesc":95,"sizeBytes":119,"sourceHtmlUrl":120},"references\u002Fworkflows.md",2948,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002Freferences\u002Fworkflows.md",{"path":122,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":125,"sourceHtmlUrl":126},"scripts\u002Fagent.py","SCRIPT","脚本",6452,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002Fscripts\u002Fagent.py",{"path":128,"resourceType":123,"resourceTypeDesc":124,"sizeBytes":129,"sourceHtmlUrl":130},"scripts\u002Fprocess.py",8541,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-escape-with-falco-rules\u002Fscripts\u002Fprocess.py",[132,159,183,209,235,262],{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":141,"publishedAt":43},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[138],{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[142,143,144,145,41,40,146,147,39,148,149,150,151,152,153,154,155,156,157,158],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":166,"publishedAt":43},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[165],{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},[167,155,168,169,41,170,40,39,171,172,173,174,175,176,177,178,179,180,181,182],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":184,"name":185,"nameZh":6,"description":186,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":187,"categories":188,"keywords":193,"publishedAt":43},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[189,192],{"categoryNo":190,"categoryName":191,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},[177,194,195,196,197,40,198,38,171,199,200,201,202,203,30,204,205,206,207,208],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":216,"publishedAt":43},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[215],{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},[217,218,219,40,220,221,222,223,224,225,226,227,228,229,230,231,174,232,233,234],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":43},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[241],{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},[243,244,245,40,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":263,"name":264,"nameZh":6,"description":265,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":266,"categories":267,"keywords":269,"publishedAt":43},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[268],{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},[41,270,40,271,35,272,273,274,275,276,277,204,278,205,279,280,281,282,283,284],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]