[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AEBCHXPSG3SGCMWF4BT1XQ":3,"skill-same:01M6AEBCHXPSG3SGCMWF4BT1XQ":104},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6AEBCHXPSG3SGCMWF4BT1XQ","detecting-container-runtime-threats-with-falco",null,"Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering driver selection, Helm installation, output channels, and the built-in ruleset that detects container escape, namespace abuse, privileged mounts, and anomalous syscalls. Use when standing Falco up on a cluster, choosing between the eBPF and kernel-module drivers, routing Falco alerts into a SIEM or Falcosidekick, or upgrading an existing deployment. Keywords: Falco, modern_ebpf, kernel module, Helm, Falcosidekick, runtime security, syscall. Do not use for authoring individual escape rules - use detecting-container-escape-with-falco-rules.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-runtime-threats-with-falco\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"detecting container runtime threats with falco","falco","engineering","syscall-monitoring","container-escape","runtime-security","detection","detection-engineering","container-security","threat-detection","docker","monitoring","ebpf","routing","deployment","siem","cybersecurity","security","kubernetes","kernel","2026-11-10 10:12:30",false,"---\nname: detecting-container-runtime-threats-with-falco\ndescription: >-\n  Deploys and operates Falco with the modern eBPF driver in Kubernetes and Docker, covering\n  driver selection, Helm installation, output channels, and the built-in ruleset that detects\n  container escape, namespace abuse, privileged mounts, and anomalous syscalls. Use when\n  standing Falco up on a cluster, choosing between the eBPF and kernel-module drivers, routing\n  Falco alerts into a SIEM or Falcosidekick, or upgrading an existing deployment. Keywords:\n  Falco, modern_ebpf, kernel module, Helm, Falcosidekick, runtime security, syscall. Do not\n  use for authoring individual escape rules - use detecting-container-escape-with-falco-rules.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- falco\n- runtime-security\n- ebpf\n- container-escape\n- syscall-monitoring\n- detection-engineering\n- kubernetes\n- threat-detection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- DE.CM-01\nmitre_attack:\n- T1611\n---\n# Detecting Container Runtime Threats with Falco\n\n## Overview\n\nFalco is the CNCF graduated runtime-security project (originally by Sysdig) that consumes Linux kernel syscalls and Kubernetes audit events through a driver, evaluates them against a YAML rule engine, and emits real-time alerts. It is the de facto open-source detection tool for runtime threats inside containers, including container escape (MITRE ATT&CK T1611, Escape to Host), namespace manipulation (`setns`), privileged mounts, reverse shells, and unexpected outbound connections.\n\nFalco supports three drivers: the **modern eBPF** probe (preferred default, requires kernel >= 5.8, shipped directly inside the Falco binary so no init container is needed), the legacy eBPF probe, and the kernel module (`kmod`). Driver selection is handled by `falcoctl driver config --type {kmod|ebpf|modern_ebpf}` or `driver.kind=modern_ebpf` in the Helm chart. On Kubernetes, Falco runs as a DaemonSet so every node is monitored, and `falcoctl` automatically installs and updates rule artifacts from the Falco rules registry.\n\nThis skill covers authoring and deploying custom Falco rules to detect the container-escape primitives and anomalous-behavior signals that the breakout techniques in this collection produce. Each Falco rule has the fields `rule`, `desc`, `condition`, `output`, `priority`, and optional `tags`; reusable logic is factored into `macro` and `list` objects. Source: falco.org official documentation; falcosecurity\u002Frules repository; Sysdig Falco detection research (e.g., CVE-2025-22224).\n\n## When to Use\n\n- Building runtime detections for a Kubernetes or Docker environment\n- Validating that container-escape and lateral-movement attempts generate alerts (purple-team)\n- Adding coverage for a newly disclosed runtime CVE\n- Hardening a SOC's container telemetry pipeline (Falco -> Falcosidekick -> SIEM)\n\n## Prerequisites\n\n- A Linux host (kernel >= 5.8 for modern eBPF) or Kubernetes cluster you administer\n- Falco install:\n  ```bash\n  # Helm (Kubernetes, modern eBPF, JSON output for SIEM ingest)\n  helm repo add falcosecurity https:\u002F\u002Ffalcosecurity.github.io\u002Fcharts\n  helm repo update\n  helm install falco falcosecurity\u002Ffalco \\\n    --namespace falco --create-namespace \\\n    --set driver.kind=modern_ebpf \\\n    --set collectors.containerd.enabled=true \\\n    --set falco.json_output=true \\\n    --set tty=true\n\n  # Linux package install (Debian\u002FUbuntu)\n  curl -fsSL https:\u002F\u002Ffalco.org\u002Frepo\u002Ffalcosecurity-packages.asc | \\\n    sudo gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg\n  echo \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg] \\\n    https:\u002F\u002Fdownload.falco.org\u002Fpackages\u002Fdeb stable main\" | \\\n    sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ffalcosecurity.list\n  sudo apt-get update -y && sudo apt-get install -y falco\n  ```\n- Basic familiarity with Falco fields (`evt.type`, `proc.name`, `container.id`, `fd.name`)\n\n## Objectives\n\n- Install Falco with the modern eBPF driver\n- Understand the rule\u002Fmacro\u002Flist schema and key Falco filter fields\n- Author custom rules for container escape, `setns`, privileged mounts, sensitive-file reads, and reverse shells\n- Load custom rules and validate syntax\n- Trigger and confirm detections (purple-team validation)\n- Forward alerts to a SIEM via Falcosidekick\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic |\n|--------------|------|--------|\n| T1611 | Escape to Host | Privilege Escalation |\n| T1059.004 | Command and Scripting Interpreter: Unix Shell | Execution |\n| T1610 | Deploy Container | Defense Evasion \u002F Execution |\n| T1543 | Create or Modify System Process | Persistence |\n| T1071.001 | Application Layer Protocol: Web Protocols | Command and Control |\n\n## Workflow\n\n### Step 1: Install Falco and Confirm the Driver\n\n```bash\n# Kubernetes: confirm the DaemonSet is running on every node\nkubectl get pods -n falco -o wide\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco | grep -i \"driver\"\n\n# Linux host: configure driver and start\nsudo falcoctl driver config --type modern_ebpf\nsudo systemctl enable --now falco-modern-bpf.service\nsudo systemctl status falco-modern-bpf.service\n```\n\n### Step 2: Learn the Rule, Macro, and List Schema\n\nCustom rules live in `\u002Fetc\u002Ffalco\u002Ffalco_rules.local.yaml` or `\u002Fetc\u002Ffalco\u002Frules.d\u002F`, referenced from `rules_files` in `\u002Fetc\u002Ffalco\u002Ffalco.yaml`.\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fcustom-escape.yaml\n- list: shell_binaries\n  items: [bash, sh, zsh, dash, ash, ksh]\n\n- macro: spawned_process\n  condition: evt.type in (execve, execveat) and evt.dir = \u003C\n\n- macro: container\n  condition: container.id != host\n```\n\n### Step 3: Write a Container-Escape Detection Rule (release_agent \u002F cgroup)\n\n```yaml\n- rule: Container Escape via cgroup release_agent\n  desc: >\n    Detect a process inside a container writing to a cgroup release_agent or\n    notify_on_release file, a classic privileged-container breakout primitive.\n  condition: >\n    container\n    and spawned_process\n    and (evt.type in (open, openat, openat2) or evt.type=write)\n    and (fd.name endswith \"release_agent\"\n         or fd.name endswith \"notify_on_release\")\n    and evt.is_open_write=true\n  output: >\n    Container escape attempt via cgroup release_agent\n    (user=%user.name command=%proc.cmdline file=%fd.name\n     container=%container.name image=%container.image.repository)\n  priority: CRITICAL\n  tags: [container, mitre_privilege_escalation, T1611]\n```\n\n### Step 4: Detect Namespace Breakout (setns \u002F nsenter)\n\n```yaml\n- rule: Namespace Change via setns to Host\n  desc: >\n    Detect setns\u002Fnsenter used to enter the host namespace (e.g. nsenter -t 1),\n    a common container-to-host escape technique.\n  condition: >\n    evt.type = setns\n    and container\n    and proc.name in (nsenter, unshare)\n  output: >\n    Namespace breakout via setns\u002Fnsenter\n    (user=%user.name proc=%proc.name cmd=%proc.cmdline\n     container=%container.name image=%container.image.repository)\n  priority: CRITICAL\n  tags: [container, mitre_privilege_escalation, T1611]\n```\n\n### Step 5: Detect Privileged Mount and Docker Socket Abuse\n\n```yaml\n- rule: Mount Launched in Privileged Container\n  desc: Detect the mount binary running inside a privileged container.\n  condition: >\n    spawned_process\n    and container\n    and container.privileged = true\n    and proc.name = mount\n  output: >\n    Mount executed in privileged container\n    (cmd=%proc.cmdline container=%container.name image=%container.image.repository)\n  priority: WARNING\n  tags: [container, mitre_privilege_escalation, T1611]\n\n- rule: Docker Socket Accessed From Container\n  desc: A container process reads\u002Fwrites the host Docker daemon socket.\n  condition: >\n    container\n    and (evt.type in (open, openat, openat2, connect))\n    and fd.name = \u002Fvar\u002Frun\u002Fdocker.sock\n  output: >\n    Container touched docker.sock - possible daemon-API escape\n    (proc=%proc.name cmd=%proc.cmdline container=%container.name)\n  priority: CRITICAL\n  tags: [container, mitre_execution, T1610]\n```\n\n### Step 6: Detect Reverse Shells and Sensitive File Reads\n\n```yaml\n- rule: Reverse Shell From Container\n  desc: A shell in a container with stdin\u002Fstdout wired to a network socket.\n  condition: >\n    spawned_process\n    and container\n    and proc.name in (shell_binaries)\n    and (fd.num in (0, 1, 2))\n    and fd.type in (ipv4, ipv6)\n  output: >\n    Reverse shell detected in container\n    (proc=%proc.cmdline connection=%fd.name container=%container.name)\n  priority: CRITICAL\n  tags: [container, mitre_execution, T1059.004]\n\n- rule: Read Sensitive Host File From Container\n  desc: Container reads \u002Fetc\u002Fshadow or similar after a likely escape.\n  condition: >\n    container\n    and (evt.type in (open, openat, openat2))\n    and evt.is_open_read=true\n    and fd.name in (\u002Fetc\u002Fshadow, \u002Fetc\u002Fsudoers, \u002Froot\u002F.ssh\u002Fid_rsa)\n  output: >\n    Sensitive file read from container (file=%fd.name proc=%proc.cmdline\n     container=%container.name)\n  priority: WARNING\n  tags: [container, mitre_credential_access]\n```\n\n### Step 7: Validate Rule Syntax and Load\n\n```bash\n# Dry-run validate a rules file without starting the engine\nsudo falco --validate \u002Fetc\u002Ffalco\u002Frules.d\u002Fcustom-escape.yaml\n\n# Run Falco with only the custom rules to test\nsudo falco -r \u002Fetc\u002Ffalco\u002Frules.d\u002Fcustom-escape.yaml\n\n# Helm: ship custom rules via values (mounted into \u002Fetc\u002Ffalco\u002Frules.d)\nhelm upgrade falco falcosecurity\u002Ffalco -n falco --reuse-values \\\n  --set-file \"customRules.custom-escape\\.yaml\"=.\u002Fcustom-escape.yaml\n```\n\n### Step 8: Trigger and Confirm (Purple-Team)\n\n```bash\n# In a test container, trigger the setns rule\nkubectl run pwn --rm -it --image=alpine --overrides='\n{\"spec\":{\"hostPID\":true,\"containers\":[{\"name\":\"pwn\",\"image\":\"alpine\",\n\"securityContext\":{\"privileged\":true},\"stdin\":true,\"tty\":true,\n\"command\":[\"sh\"]}]}}' -- sh -c 'nsenter -t 1 -m -u -i -n -p -- id'\n\n# Confirm the alert fired\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco | grep -i \"Namespace breakout\"\n```\n\n### Step 9: Forward Alerts to a SIEM\n\n```bash\n# Deploy Falcosidekick to fan out alerts (Elastic, Slack, Splunk, etc.)\nhelm upgrade falco falcosecurity\u002Ffalco -n falco --reuse-values \\\n  --set falcosidekick.enabled=true \\\n  --set falcosidekick.config.elasticsearch.hostport=https:\u002F\u002Felastic:9200 \\\n  --set falcosidekick.config.elasticsearch.index=falco\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| Falco | Runtime syscall detection engine | https:\u002F\u002Ffalco.org |\n| falcoctl | Driver + rules artifact manager | https:\u002F\u002Fgithub.com\u002Ffalcosecurity\u002Ffalcoctl |\n| falcosecurity\u002Frules | Maintained default ruleset | https:\u002F\u002Fgithub.com\u002Ffalcosecurity\u002Frules |\n| Falcosidekick | Alert fan-out to SIEM\u002Fchat | https:\u002F\u002Fgithub.com\u002Ffalcosecurity\u002Ffalcosidekick |\n| Falco Helm chart | Kubernetes DaemonSet deploy | https:\u002F\u002Fgithub.com\u002Ffalcosecurity\u002Fcharts |\n\n## Key Falco Filter Fields\n\n| Field | Meaning |\n|-------|---------|\n| `evt.type` | Syscall name (execve, setns, open, connect) |\n| `evt.dir` | Event direction (`\u003C` exit, `>` enter) |\n| `proc.name` \u002F `proc.cmdline` | Process name \u002F full command line |\n| `container.id` \u002F `container.privileged` | Container identity \u002F privileged flag |\n| `container.image.repository` | Image name |\n| `fd.name` \u002F `fd.type` | File\u002Fsocket path \u002F type (ipv4, ipv6) |\n| `evt.is_open_write` \u002F `evt.is_open_read` | Open intent |\n| `user.name` | Acting user |\n\n## Validation Criteria\n\n- [ ] Falco installed with the modern eBPF driver (DaemonSet on all nodes)\n- [ ] Custom rules file validated with `falco --validate`\n- [ ] release_agent \u002F setns \u002F privileged-mount \u002F docker.sock rules loaded\n- [ ] Reverse-shell and sensitive-file-read rules loaded\n- [ ] Each rule triggered in a lab and the alert confirmed in logs\n- [ ] Priorities set appropriately (CRITICAL for escape primitives)\n- [ ] Alerts forwarded to the SIEM via Falcosidekick\n- [ ] Rule tags include the relevant MITRE technique IDs\n","# Detecting Container Runtime Threats with Falco\n\n## Overview\n\nFalco is the CNCF graduated runtime-security project (originally by Sysdig) that consumes Linux kernel syscalls and Kubernetes audit events through a driver, evaluates them against a YAML rule engine, and emits real-time alerts. It is the de facto open-source detection tool for runtime threats inside containers, including container escape (MITRE ATT&CK T1611, Escape to Host), namespace manipulation (`setns`), privileged mounts, reverse shells, and unexpected outbound connections.\n\nFalco supports three drivers: the **modern eBPF** probe (preferred default, requires kernel >= 5.8, shipped directly inside the Falco binary so no init container is needed), the legacy eBPF probe, and the kernel module (`kmod`). Driver selection is handled by `falcoctl driver config --type {kmod|ebpf|modern_ebpf}` or `driver.kind=modern_ebpf` in the Helm chart. On Kubernetes, Falco runs as a DaemonSet so every node is monitored, and `falcoctl` automatically installs and updates rule artifacts from the Falco rules registry.\n\nThis skill covers authoring and deploying custom Falco rules to detect the container-escape primitives and anomalous-behavior signals that the breakout techniques in this collection produce. Each Falco rule has the fields `rule`, `desc`, `condition`, `output`, `priority`, and optional `tags`; reusable logic is factored into `macro` and `list` objects. Source: falco.org official documentation; falcosecurity\u002Frules repository; Sysdig Falco detection research (e.g., CVE-2025-22224).\n\n## When to Use\n\n- Building runtime detections for a Kubernetes or Docker environment\n- Validating that container-escape and lateral-movement attempts generate alerts (purple-team)\n- Adding coverage for a newly disclosed runtime CVE\n- Hardening a SOC's container telemetry pipeline (Falco -> Falcosidekick -> SIEM)\n\n## Prerequisites\n\n- A Linux host (kernel >= 5.8 for modern eBPF) or Kubernetes cluster you administer\n- Falco install:\n  ```bash\n  # Helm (Kubernetes, modern eBPF, JSON output for SIEM ingest)\n  helm repo add falcosecurity https:\u002F\u002Ffalcosecurity.github.io\u002Fcharts\n  helm repo update\n  helm install falco falcosecurity\u002Ffalco \\\n    --namespace falco --create-namespace \\\n    --set driver.kind=modern_ebpf \\\n    --set collectors.containerd.enabled=true \\\n    --set falco.json_output=true \\\n    --set tty=true\n\n  # Linux package install (Debian\u002FUbuntu)\n  curl -fsSL https:\u002F\u002Ffalco.org\u002Frepo\u002Ffalcosecurity-packages.asc | \\\n    sudo gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg\n  echo \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg] \\\n    https:\u002F\u002Fdownload.falco.org\u002Fpackages\u002Fdeb stable main\" | \\\n    sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ffalcosecurity.list\n  sudo apt-get update -y && sudo apt-get install -y falco\n  ```\n- Basic familiarity with Falco fields (`evt.type`, `proc.name`, `container.id`, `fd.name`)\n\n## Objectives\n\n- Install Falco with the modern eBPF driver\n- Understand the rule\u002Fmacro\u002Flist schema and key Falco filter fields\n- Author custom rules for container escape, `setns`, privileged mounts, sensitive-file reads, and reverse shells\n- Load custom rules and validate syntax\n- Trigger and confirm detections (purple-team validation)\n- Forward alerts to a SIEM via Falcosidekick\n\n## MITRE ATT&CK Mapping\n\n| Technique ID | Name | Tactic |\n|--------------|------|--------|\n| T1611 | Escape to Host | Privilege Escalation |\n| T1059.004 | Command and Scripting Interpreter: Unix Shell | Execution |\n| T1610 | Deploy Container | Defense Evasion \u002F Execution |\n| T1543 | Create or Modify System Process | Persistence |\n| T1071.001 | Application Layer Protocol: Web Protocols | Command and Control |\n\n## Workflow\n\n### Step 1: Install Falco and Confirm the Driver\n\n```bash\n# Kubernetes: confirm the DaemonSet is running on every node\nkubectl get pods -n falco -o wide\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco | grep -i \"driver\"\n\n# Linux host: configure driver and start\nsudo falcoctl driver config --type modern_ebpf\nsudo systemctl enable --now falco-modern-bpf.service\nsudo systemctl status falco-modern-bpf.service\n```\n\n### Step 2: Learn the Rule, Macro, and List Schema\n\nCustom rules live in `\u002Fetc\u002Ffalco\u002Ffalco_rules.local.yaml` or `\u002Fetc\u002Ffalco\u002Frules.d\u002F`, referenced from `rules_files` in `\u002Fetc\u002Ffalco\u002Ffalco.yaml`.\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fcustom-escape.yaml\n- list: shell_binaries\n  items: [bash, sh, zsh, dash, ash, ksh]\n\n- macro: spawned_process\n  condition: evt.type in (execve, execveat) and evt.dir = \u003C\n\n- macro: container\n  condition: container.id != host\n```\n\n### Step 3: Write a Container-Escape Detection Rule (release_agent \u002F cgroup)\n\n```yaml\n- rule: Container Escape via cgroup release_agent\n  desc: >\n    Detect a process inside a container writing to a cgroup release_agent or\n    notify_on_release file, a classic privileged-container breakout primitive.\n  condition: >\n    container\n    and spawned_process\n    and (evt.type in (open, openat, openat2) or evt.type=write)\n    and (fd.name endswith \"release_agent\"\n         or fd.name endswith \"notify_on_release\")\n    and evt.is_open_write=true\n  output: >\n    Container escape attempt via cgroup release_agent\n    (user=%user.name command=%proc.cmdline file=%fd.name\n     container=%container.name image=%container.image.repository)\n  priority: CRITICAL\n  tags: [container, mitre_privilege_escalation, T1611]\n```\n\n### Step 4: Detect Namespace Breakout (setns \u002F nsenter)\n\n```yaml\n- rule: Namespace Change via setns to Host\n  desc: >\n    Detect setns\u002Fnsenter used to enter the host namespace (e.g. nsenter -t 1),\n    a common container-to-host escape technique.\n  condition: >\n    evt.type = setns\n    and container\n    and proc.name in (nsenter, unshare)\n  output: >\n    Namespace breakout via setns\u002Fnsenter\n    (user=%user.name proc=%proc.name cmd=%proc.cmdline\n     container=%container.name image=%container.image.repository)\n  priority: CRITICAL\n  tags: [container, mitre_privilege_escalation, T1611]\n```\n\n### Step 5: Detect Privileged Mount and Docker Socket Abuse\n\n```yaml\n- rule: Mount Launched in Privileged Container\n  desc: Detect the mount binary running inside a privileged container.\n  condition: >\n    spawned_process\n    and container\n    and container.privileged = true\n    and proc.name = mount\n  output: >\n    Mount executed in privileged container\n    (cmd=%proc.cmdline container=%container.name image=%container.image.repository)\n  priority: WARNING\n  tags: [container, mitre_privilege_escalation, T1611]\n\n- rule: Docker Socket Accessed From Container\n  desc: A container process reads\u002Fwrites the host Docker daemon socket.\n  condition: >\n    container\n    and (evt.type in (open, openat, openat2, connect))\n    and fd.name = \u002Fvar\u002Frun\u002Fdocker.sock\n  output: >\n    Container touched docker.sock - possible daemon-API escape\n    (proc=%proc.name cmd=%proc.cmdline container=%container.name)\n  priority: CRITICAL\n  tags: [container, mitre_execution, T1610]\n```\n\n### Step 6: Detect Reverse Shells and Sensitive File Reads\n\n```yaml\n- rule: Reverse Shell From Container\n  desc: A shell in a container with stdin\u002Fstdout wired to a network socket.\n  condition: >\n    spawned_process\n    and container\n    and proc.name in (shell_binaries)\n    and (fd.num in (0, 1, 2))\n    and fd.type in (ipv4, ipv6)\n  output: >\n    Reverse shell detected in container\n    (proc=%proc.cmdline connection=%fd.name container=%container.name)\n  priority: CRITICAL\n  tags: [container, mitre_execution, T1059.004]\n\n- rule: Read Sensitive Host File From Container\n  desc: Container reads \u002Fetc\u002Fshadow or similar after a likely escape.\n  condition: >\n    container\n    and (evt.type in (open, openat, openat2))\n    and evt.is_open_read=true\n    and fd.name in (\u002Fetc\u002Fshadow, \u002Fetc\u002Fsudoers, \u002Froot\u002F.ssh\u002Fid_rsa)\n  output: >\n    Sensitive file read from container (file=%fd.name proc=%proc.cmdline\n     container=%container.name)\n  priority: WARNING\n  tags: [container, mitre_credential_access]\n```\n\n### Step 7: Validate Rule Syntax and Load\n\n```bash\n# Dry-run validate a rules file without starting the engine\nsudo falco --validate \u002Fetc\u002Ffalco\u002Frules.d\u002Fcustom-escape.yaml\n\n# Run Falco with only the custom rules to test\nsudo falco -r \u002Fetc\u002Ffalco\u002Frules.d\u002Fcustom-escape.yaml\n\n# Helm: ship custom rules via values (mounted into \u002Fetc\u002Ffalco\u002Frules.d)\nhelm upgrade falco falcosecurity\u002Ffalco -n falco --reuse-values \\\n  --set-file \"customRules.custom-escape\\.yaml\"=.\u002Fcustom-escape.yaml\n```\n\n### Step 8: Trigger and Confirm (Purple-Team)\n\n```bash\n# In a test container, trigger the setns rule\nkubectl run pwn --rm -it --image=alpine --overrides='\n{\"spec\":{\"hostPID\":true,\"containers\":[{\"name\":\"pwn\",\"image\":\"alpine\",\n\"securityContext\":{\"privileged\":true},\"stdin\":true,\"tty\":true,\n\"command\":[\"sh\"]}]}}' -- sh -c 'nsenter -t 1 -m -u -i -n -p -- id'\n\n# Confirm the alert fired\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco | grep -i \"Namespace breakout\"\n```\n\n### Step 9: Forward Alerts to a SIEM\n\n```bash\n# Deploy Falcosidekick to fan out alerts (Elastic, Slack, Splunk, etc.)\nhelm upgrade falco falcosecurity\u002Ffalco -n falco --reuse-values \\\n  --set falcosidekick.enabled=true \\\n  --set falcosidekick.config.elasticsearch.hostport=https:\u002F\u002Felastic:9200 \\\n  --set falcosidekick.config.elasticsearch.index=falco\n```\n\n## Tools and Resources\n\n| Tool | Purpose | Source |\n|------|---------|--------|\n| Falco | Runtime syscall detection engine | https:\u002F\u002Ffalco.org |\n| falcoctl | Driver + rules artifact manager | https:\u002F\u002Fgithub.com\u002Ffalcosecurity\u002Ffalcoctl |\n| falcosecurity\u002Frules | Maintained default ruleset | https:\u002F\u002Fgithub.com\u002Ffalcosecurity\u002Frules |\n| Falcosidekick | Alert fan-out to SIEM\u002Fchat | https:\u002F\u002Fgithub.com\u002Ffalcosecurity\u002Ffalcosidekick |\n| Falco Helm chart | Kubernetes DaemonSet deploy | https:\u002F\u002Fgithub.com\u002Ffalcosecurity\u002Fcharts |\n\n## Key Falco Filter Fields\n\n| Field | Meaning |\n|-------|---------|\n| `evt.type` | Syscall name (execve, setns, open, connect) |\n| `evt.dir` | Event direction (`\u003C` exit, `>` enter) |\n| `proc.name` \u002F `proc.cmdline` | Process name \u002F full command line |\n| `container.id` \u002F `container.privileged` | Container identity \u002F privileged flag |\n| `container.image.repository` | Image name |\n| `fd.name` \u002F `fd.type` | File\u002Fsocket path \u002F type (ipv4, ipv6) |\n| `evt.is_open_write` \u002F `evt.is_open_read` | Open intent |\n| `user.name` | Acting user |\n\n## Validation Criteria\n\n- [ ] Falco installed with the modern eBPF driver (DaemonSet on all nodes)\n- [ ] Custom rules file validated with `falco --validate`\n- [ ] release_agent \u002F setns \u002F privileged-mount \u002F docker.sock rules loaded\n- [ ] Reverse-shell and sensitive-file-read rules loaded\n- [ ] Each rule triggered in a lab and the alert confirmed in logs\n- [ ] Priorities set appropriately (CRITICAL for escape primitives)\n- [ ] Alerts forwarded to the SIEM via Falcosidekick\n- [ ] Rule tags include the relevant MITRE technique IDs\n",{"name":5,"tags":52,"author":53,"domain":43,"license":15,"version":54,"nist_csf":55,"subdomain":35,"description":7,"mitre_attack":57},[28,32,39,31,30,34,45,36],"mahipal","1.0",[56],"DE.CM-01",[58],"T1611","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-container-runtime-threats-with-falco",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-container-runtime-threats-with-falco",{"tool":75,"command":76},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-container-runtime-threats-with-falco",{"tool":78,"command":79},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-container-runtime-threats-with-falco","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-runtime-threats-with-falco\u002FSKILL.md",true,[83,88,94,98],{"path":84,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-runtime-threats-with-falco\u002FLICENSE",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fapi-reference.md","REFERENCE","参考文档",2689,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-runtime-threats-with-falco\u002Freferences\u002Fapi-reference.md",{"path":95,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":96,"sourceHtmlUrl":97},"references\u002Fstandards.md",1821,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-runtime-threats-with-falco\u002Freferences\u002Fstandards.md",{"path":99,"resourceType":100,"resourceTypeDesc":101,"sizeBytes":102,"sourceHtmlUrl":103},"scripts\u002Fagent.py","SCRIPT","脚本",5214,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-container-runtime-threats-with-falco\u002Fscripts\u002Fagent.py",[105,131,155,182,208,235],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":112,"publishedAt":47},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[111],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,116,44,43,117,118,119,120,121,122,123,124,125,126,127,128,129,130],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":132,"name":133,"nameZh":6,"description":134,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":135,"categories":136,"keywords":138,"publishedAt":47},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[137],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[139,127,140,141,44,142,43,119,143,144,145,146,147,148,149,150,151,152,153,154],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":47},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[161,164],{"categoryNo":162,"categoryName":163,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[149,166,167,168,169,43,170,171,143,172,173,174,175,176,33,177,178,179,180,181],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":189,"publishedAt":47},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[188],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[190,191,192,43,193,194,195,196,197,198,199,200,201,202,203,204,146,205,206,207],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":209,"name":210,"nameZh":6,"description":211,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":212,"categories":213,"keywords":215,"publishedAt":47},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[214],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[216,217,218,43,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":236,"name":237,"nameZh":6,"description":238,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":239,"categories":240,"keywords":242,"publishedAt":47},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[241],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[44,243,43,42,244,245,246,247,248,249,250,177,251,178,252,253,254,255,256,257],"triaging security incident","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]