[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71CMR9T3B67ZBHT9V83G89C":3,"skill-same:01M71CMR9T3B67ZBHT9V83G89C":102},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":75,"commitSha":76,"skillDirectory":77,"forksCount":14,"repositoryHtmlUrl":78,"repositoryHomepageUrl":6,"ownerHtmlUrl":79,"ownerBlogUrl":6,"ownerDescription":80,"updatedAt":81,"install":82,"resources":95},"01M71CMR9T3B67ZBHT9V83G89C","kubernetes-runtime-falco-detect",null,"Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fruntime\u002Ffalco\u002Fdetect\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"kubernetes runtime falco detect","runtime","kubernetes","detect","falco","privilege escalation","container-security","command","de","monitoring","analysis","Bash","access","cybersecurity","syscall-monitoring","container-escape","time","cm","container escape","runtime-security","2026-11-10 10:12:30",false,"---\nname: kubernetes-runtime-falco-detect\ndescription: Detect container escape attempts in real-time using Falco runtime security rules that monitor syscalls, file access, and privilege escalation.\ndomain: cybersecurity\nsubdomain: container-security\ntags:\n- falco\n- container-escape\n- runtime-security\n- syscall-monitoring\n- kubernetes\n- detection\nd3fend_techniques:\n- Token Binding\n- Execution Isolation\n- File Metadata Consistency Validation\n- Restore Access\n- Application Protocol Command Analysis\nnist_csf:\n- PR.PS-01\n- PR.IR-01\n- ID.AM-08\n- DE.CM-01\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1610\n- T1611\ncve:\n- CVE-2022-0492\ncapec: []\n---\n\n# Detecting Container Escape with Falco Rules\n\n## Overview\n\nFalco is a CNCF-graduated runtime security tool that monitors Linux syscalls to detect anomalous container behavior. It uses a rules engine to identify container escape techniques such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting container escape with falco rules\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Linux host with kernel 5.8+ (for eBPF driver) or kernel module support\n- Kubernetes cluster (v1.24+) or standalone Docker\u002Fcontainerd\n- Helm 3 for Kubernetes deployment\n- Root or privileged access for driver installation\n\n## Installing Falco\n\n### Kubernetes Deployment with Helm\n\n```bash\n# Add Falco Helm chart\nhelm repo add falcosecurity https:\u002F\u002Ffalcosecurity.github.io\u002Fcharts\nhelm repo update\n\n# Install Falco with eBPF driver\nhelm install falco falcosecurity\u002Ffalco \\\n  --namespace falco --create-namespace \\\n  --set falcosidekick.enabled=true \\\n  --set falcosidekick.webui.enabled=true \\\n  --set driver.kind=ebpf \\\n  --set collectors.containerd.enabled=true \\\n  --set collectors.containerd.socket=\u002Frun\u002Fcontainerd\u002Fcontainerd.sock\n\n# Verify\nkubectl get pods -n falco\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco --tail=20\n```\n\n### Standalone Installation (Debian\u002FUbuntu)\n\n```bash\n# Add Falco GPG key and repo\ncurl -fsSL https:\u002F\u002Ffalco.org\u002Frepo\u002Ffalcosecurity-packages.asc | \\\n  sudo gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg\n\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg] https:\u002F\u002Fdownload.falco.org\u002Fpackages\u002Fdeb stable main\" | \\\n  sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ffalcosecurity.list\n\nsudo apt-get update\nsudo apt-get install -y falco\n\n# Start Falco\nsudo systemctl enable falco\nsudo systemctl start falco\n```\n\n## Container Escape Detection Rules\n\n### Rule 1: Detect Host Mount from Container\n\n```yaml\n- rule: Container Mounting Host Filesystem\n  desc: Detect a container attempting to mount the host filesystem\n  condition: >\n    spawned_process and container and\n    proc.name = mount and\n    (proc.args contains \"\u002Fhost\" or proc.args contains \"nsenter\")\n  output: >\n    Container mounting host filesystem\n    (user=%user.name container_id=%container.id container_name=%container.name\n     image=%container.image.repository command=%proc.cmdline %evt.args)\n  priority: CRITICAL\n  tags: [container, escape, T1611]\n```\n\n### Rule 2: Detect nsenter Usage (Namespace Escape)\n\n```yaml\n- rule: Nsenter Execution in Container\n  desc: Detect nsenter being used to escape container namespaces\n  condition: >\n    spawned_process and container and proc.name = nsenter\n  output: >\n    nsenter executed in container - potential escape attempt\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname)\n  priority: CRITICAL\n  tags: [container, escape, namespace, T1611]\n```\n\n### Rule 3: Detect Privileged Container Launch\n\n```yaml\n- rule: Launch Privileged Container\n  desc: Detect a privileged container being launched\n  condition: >\n    container_started and container and container.privileged=true\n  output: >\n    Privileged container started\n    (user=%user.name container_id=%container.id container_name=%container.name\n     image=%container.image.repository)\n  priority: WARNING\n  tags: [container, privileged, T1610]\n```\n\n### Rule 4: Detect \u002Fproc\u002Fsysrq-trigger Write\n\n```yaml\n- rule: Write to Sysrq Trigger\n  desc: Detect writes to \u002Fproc\u002Fsysrq-trigger which can crash or control the host\n  condition: >\n    open_write and container and fd.name = \u002Fproc\u002Fsysrq-trigger\n  output: >\n    Write to \u002Fproc\u002Fsysrq-trigger from container\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, host-manipulation]\n```\n\n### Rule 5: Detect Kernel Module Loading from Container\n\n```yaml\n- rule: Container Loading Kernel Module\n  desc: Detect a container attempting to load a kernel module\n  condition: >\n    spawned_process and container and\n    (proc.name in (insmod, modprobe) or\n     (proc.name = init_module))\n  output: >\n    Kernel module loading from container\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, kernel, T1611]\n```\n\n### Rule 6: Detect Container Breakout via cgroups\n\n```yaml\n- rule: Write to Cgroup Release Agent\n  desc: Detect writes to cgroup release_agent which is a known container escape vector\n  condition: >\n    open_write and container and\n    fd.name endswith release_agent\n  output: >\n    Container writing to cgroup release_agent - escape attempt\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     file=%fd.name command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, cgroup, CVE-2022-0492]\n```\n\n### Rule 7: Detect Access to Host \u002Fetc\u002Fshadow\n\n```yaml\n- rule: Container Reading Host Shadow File\n  desc: Detect a container reading \u002Fetc\u002Fshadow on the host via mounted volume\n  condition: >\n    open_read and container and\n    (fd.name = \u002Fetc\u002Fshadow or fd.name startswith \u002Fhost\u002Fetc\u002Fshadow)\n  output: >\n    Container reading host shadow file\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     file=%fd.name command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, credential-access, T1003]\n```\n\n### Rule 8: Detect Docker Socket Access\n\n```yaml\n- rule: Container Accessing Docker Socket\n  desc: Detect a container accessing the Docker socket which allows host control\n  condition: >\n    (open_read or open_write) and container and\n    fd.name = \u002Fvar\u002Frun\u002Fdocker.sock\n  output: >\n    Container accessing Docker socket\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, docker-socket, T1610]\n```\n\n## Complete Custom Rules File\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer-escape.yaml\n- list: escape_binaries\n  items: [nsenter, chroot, unshare, mount, umount, pivot_root]\n\n- macro: container_escape_attempt\n  condition: >\n    spawned_process and container and\n    proc.name in (escape_binaries)\n\n- rule: Container Escape Binary Execution\n  desc: Detect execution of binaries commonly used for container escape\n  condition: container_escape_attempt\n  output: >\n    Escape-related binary executed in container\n    (user=%user.name container=%container.name image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname pid=%proc.pid)\n  priority: CRITICAL\n  tags: [container, escape, mitre_T1611]\n\n- rule: Sensitive File Access from Container\n  desc: Detect container access to sensitive host files\n  condition: >\n    (open_read or open_write) and container and\n    (fd.name startswith \u002Fproc\u002F1\u002F or\n     fd.name = \u002Fetc\u002Fshadow or\n     fd.name = \u002Fetc\u002Fkubernetes\u002Fadmin.conf or\n     fd.name startswith \u002Fvar\u002Flib\u002Fkubelet\u002F)\n  output: >\n    Sensitive file accessed from container\n    (container=%container.name image=%container.image.repository\n     file=%fd.name command=%proc.cmdline user=%user.name)\n  priority: CRITICAL\n  tags: [container, sensitive-file, mitre_T1005]\n```\n\n## Falco Configuration\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Ffalco.yaml (key settings)\nrules_files:\n  - \u002Fetc\u002Ffalco\u002Ffalco_rules.yaml\n  - \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer-escape.yaml\n\njson_output: true\njson_include_output_property: true\njson_include_tags_property: true\n\nlog_stderr: true\nlog_syslog: true\nlog_level: info\n\npriority: WARNING\n\nstdout_output:\n  enabled: true\n\nsyslog_output:\n  enabled: true\n\nhttp_output:\n  enabled: true\n  url: http:\u002F\u002Ffalcosidekick:2801\n  insecure: true\n\ngrpc:\n  enabled: true\n  bind_address: \"unix:\u002F\u002F\u002Frun\u002Ffalco\u002Ffalco.sock\"\n  threadiness: 8\n\ngrpc_output:\n  enabled: true\n```\n\n## Alert Integration\n\n### Forward to Slack via Falcosidekick\n\n```yaml\n# Falcosidekick values.yaml\nconfig:\n  slack:\n    webhookurl: \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FXXXXX\"\n    minimumpriority: \"warning\"\n    messageformat: |\n      *{{.Priority}}* - {{.Rule}}\n      Container: {{.OutputFields.container_name}}\n      Image: {{.OutputFields.container_image_repository}}\n      Command: {{.OutputFields.proc_cmdline}}\n```\n\n## Testing Rules\n\n```bash\n# Simulate container escape attempt (in a test container)\nkubectl run test-escape --image=alpine --restart=Never -- sh -c \"cat \u002Fetc\u002Fshadow\"\n\n# Simulate nsenter\nkubectl run test-nsenter --image=alpine --restart=Never --overrides='{\"spec\":{\"hostPID\":true}}' -- nsenter -t 1 -m -u -i -n -- cat \u002Fetc\u002Fhostname\n\n# Check Falco alerts\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco --tail=50 | grep -i escape\n```\n\n## Best Practices\n\n1. **Deploy Falco as DaemonSet** to ensure coverage on all nodes\n2. **Use eBPF driver** over kernel module for safer operation\n3. **Start with default rules** (maturity_stable) then add custom rules\n4. **Forward alerts** to SIEM\u002FSOAR via Falcosidekick\n5. **Tag rules with MITRE ATT&CK** technique IDs for correlation\n6. **Test rules** in permissive mode before enforcing\n7. **Tune false positives** by adding exception lists for known good processes\n8. **Monitor Falco health** with Prometheus metrics endpoint\n","# Detecting Container Escape with Falco Rules\n\n## Overview\n\nFalco is a CNCF-graduated runtime security tool that monitors Linux syscalls to detect anomalous container behavior. It uses a rules engine to identify container escape techniques such as mounting host filesystems, accessing sensitive host paths, loading kernel modules, and exploiting privileged container capabilities.\n\n\n## When to Use\n\n- When investigating security incidents that require detecting container escape with falco rules\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Linux host with kernel 5.8+ (for eBPF driver) or kernel module support\n- Kubernetes cluster (v1.24+) or standalone Docker\u002Fcontainerd\n- Helm 3 for Kubernetes deployment\n- Root or privileged access for driver installation\n\n## Installing Falco\n\n### Kubernetes Deployment with Helm\n\n```bash\n# Add Falco Helm chart\nhelm repo add falcosecurity https:\u002F\u002Ffalcosecurity.github.io\u002Fcharts\nhelm repo update\n\n# Install Falco with eBPF driver\nhelm install falco falcosecurity\u002Ffalco \\\n  --namespace falco --create-namespace \\\n  --set falcosidekick.enabled=true \\\n  --set falcosidekick.webui.enabled=true \\\n  --set driver.kind=ebpf \\\n  --set collectors.containerd.enabled=true \\\n  --set collectors.containerd.socket=\u002Frun\u002Fcontainerd\u002Fcontainerd.sock\n\n# Verify\nkubectl get pods -n falco\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco --tail=20\n```\n\n### Standalone Installation (Debian\u002FUbuntu)\n\n```bash\n# Add Falco GPG key and repo\ncurl -fsSL https:\u002F\u002Ffalco.org\u002Frepo\u002Ffalcosecurity-packages.asc | \\\n  sudo gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg\n\necho \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Ffalco-archive-keyring.gpg] https:\u002F\u002Fdownload.falco.org\u002Fpackages\u002Fdeb stable main\" | \\\n  sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Ffalcosecurity.list\n\nsudo apt-get update\nsudo apt-get install -y falco\n\n# Start Falco\nsudo systemctl enable falco\nsudo systemctl start falco\n```\n\n## Container Escape Detection Rules\n\n### Rule 1: Detect Host Mount from Container\n\n```yaml\n- rule: Container Mounting Host Filesystem\n  desc: Detect a container attempting to mount the host filesystem\n  condition: >\n    spawned_process and container and\n    proc.name = mount and\n    (proc.args contains \"\u002Fhost\" or proc.args contains \"nsenter\")\n  output: >\n    Container mounting host filesystem\n    (user=%user.name container_id=%container.id container_name=%container.name\n     image=%container.image.repository command=%proc.cmdline %evt.args)\n  priority: CRITICAL\n  tags: [container, escape, T1611]\n```\n\n### Rule 2: Detect nsenter Usage (Namespace Escape)\n\n```yaml\n- rule: Nsenter Execution in Container\n  desc: Detect nsenter being used to escape container namespaces\n  condition: >\n    spawned_process and container and proc.name = nsenter\n  output: >\n    nsenter executed in container - potential escape attempt\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname)\n  priority: CRITICAL\n  tags: [container, escape, namespace, T1611]\n```\n\n### Rule 3: Detect Privileged Container Launch\n\n```yaml\n- rule: Launch Privileged Container\n  desc: Detect a privileged container being launched\n  condition: >\n    container_started and container and container.privileged=true\n  output: >\n    Privileged container started\n    (user=%user.name container_id=%container.id container_name=%container.name\n     image=%container.image.repository)\n  priority: WARNING\n  tags: [container, privileged, T1610]\n```\n\n### Rule 4: Detect \u002Fproc\u002Fsysrq-trigger Write\n\n```yaml\n- rule: Write to Sysrq Trigger\n  desc: Detect writes to \u002Fproc\u002Fsysrq-trigger which can crash or control the host\n  condition: >\n    open_write and container and fd.name = \u002Fproc\u002Fsysrq-trigger\n  output: >\n    Write to \u002Fproc\u002Fsysrq-trigger from container\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, host-manipulation]\n```\n\n### Rule 5: Detect Kernel Module Loading from Container\n\n```yaml\n- rule: Container Loading Kernel Module\n  desc: Detect a container attempting to load a kernel module\n  condition: >\n    spawned_process and container and\n    (proc.name in (insmod, modprobe) or\n     (proc.name = init_module))\n  output: >\n    Kernel module loading from container\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, kernel, T1611]\n```\n\n### Rule 6: Detect Container Breakout via cgroups\n\n```yaml\n- rule: Write to Cgroup Release Agent\n  desc: Detect writes to cgroup release_agent which is a known container escape vector\n  condition: >\n    open_write and container and\n    fd.name endswith release_agent\n  output: >\n    Container writing to cgroup release_agent - escape attempt\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     file=%fd.name command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, cgroup, CVE-2022-0492]\n```\n\n### Rule 7: Detect Access to Host \u002Fetc\u002Fshadow\n\n```yaml\n- rule: Container Reading Host Shadow File\n  desc: Detect a container reading \u002Fetc\u002Fshadow on the host via mounted volume\n  condition: >\n    open_read and container and\n    (fd.name = \u002Fetc\u002Fshadow or fd.name startswith \u002Fhost\u002Fetc\u002Fshadow)\n  output: >\n    Container reading host shadow file\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     file=%fd.name command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, credential-access, T1003]\n```\n\n### Rule 8: Detect Docker Socket Access\n\n```yaml\n- rule: Container Accessing Docker Socket\n  desc: Detect a container accessing the Docker socket which allows host control\n  condition: >\n    (open_read or open_write) and container and\n    fd.name = \u002Fvar\u002Frun\u002Fdocker.sock\n  output: >\n    Container accessing Docker socket\n    (user=%user.name container_id=%container.id image=%container.image.repository\n     command=%proc.cmdline)\n  priority: CRITICAL\n  tags: [container, escape, docker-socket, T1610]\n```\n\n## Complete Custom Rules File\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer-escape.yaml\n- list: escape_binaries\n  items: [nsenter, chroot, unshare, mount, umount, pivot_root]\n\n- macro: container_escape_attempt\n  condition: >\n    spawned_process and container and\n    proc.name in (escape_binaries)\n\n- rule: Container Escape Binary Execution\n  desc: Detect execution of binaries commonly used for container escape\n  condition: container_escape_attempt\n  output: >\n    Escape-related binary executed in container\n    (user=%user.name container=%container.name image=%container.image.repository\n     command=%proc.cmdline parent=%proc.pname pid=%proc.pid)\n  priority: CRITICAL\n  tags: [container, escape, mitre_T1611]\n\n- rule: Sensitive File Access from Container\n  desc: Detect container access to sensitive host files\n  condition: >\n    (open_read or open_write) and container and\n    (fd.name startswith \u002Fproc\u002F1\u002F or\n     fd.name = \u002Fetc\u002Fshadow or\n     fd.name = \u002Fetc\u002Fkubernetes\u002Fadmin.conf or\n     fd.name startswith \u002Fvar\u002Flib\u002Fkubelet\u002F)\n  output: >\n    Sensitive file accessed from container\n    (container=%container.name image=%container.image.repository\n     file=%fd.name command=%proc.cmdline user=%user.name)\n  priority: CRITICAL\n  tags: [container, sensitive-file, mitre_T1005]\n```\n\n## Falco Configuration\n\n```yaml\n# \u002Fetc\u002Ffalco\u002Ffalco.yaml (key settings)\nrules_files:\n  - \u002Fetc\u002Ffalco\u002Ffalco_rules.yaml\n  - \u002Fetc\u002Ffalco\u002Frules.d\u002Fcontainer-escape.yaml\n\njson_output: true\njson_include_output_property: true\njson_include_tags_property: true\n\nlog_stderr: true\nlog_syslog: true\nlog_level: info\n\npriority: WARNING\n\nstdout_output:\n  enabled: true\n\nsyslog_output:\n  enabled: true\n\nhttp_output:\n  enabled: true\n  url: http:\u002F\u002Ffalcosidekick:2801\n  insecure: true\n\ngrpc:\n  enabled: true\n  bind_address: \"unix:\u002F\u002F\u002Frun\u002Ffalco\u002Ffalco.sock\"\n  threadiness: 8\n\ngrpc_output:\n  enabled: true\n```\n\n## Alert Integration\n\n### Forward to Slack via Falcosidekick\n\n```yaml\n# Falcosidekick values.yaml\nconfig:\n  slack:\n    webhookurl: \"https:\u002F\u002Fhooks.slack.com\u002Fservices\u002FXXXXX\"\n    minimumpriority: \"warning\"\n    messageformat: |\n      *{{.Priority}}* - {{.Rule}}\n      Container: {{.OutputFields.container_name}}\n      Image: {{.OutputFields.container_image_repository}}\n      Command: {{.OutputFields.proc_cmdline}}\n```\n\n## Testing Rules\n\n```bash\n# Simulate container escape attempt (in a test container)\nkubectl run test-escape --image=alpine --restart=Never -- sh -c \"cat \u002Fetc\u002Fshadow\"\n\n# Simulate nsenter\nkubectl run test-nsenter --image=alpine --restart=Never --overrides='{\"spec\":{\"hostPID\":true}}' -- nsenter -t 1 -m -u -i -n -- cat \u002Fetc\u002Fhostname\n\n# Check Falco alerts\nkubectl logs -n falco -l app.kubernetes.io\u002Fname=falco --tail=50 | grep -i escape\n```\n\n## Best Practices\n\n1. **Deploy Falco as DaemonSet** to ensure coverage on all nodes\n2. **Use eBPF driver** over kernel module for safer operation\n3. **Start with default rules** (maturity_stable) then add custom rules\n4. **Forward alerts** to SIEM\u002FSOAR via Falcosidekick\n5. **Tag rules with MITRE ATT&CK** technique IDs for correlation\n6. **Test rules** in permissive mode before enforcing\n7. **Tune false positives** by adding exception lists for known good processes\n8. **Monitor Falco health** with Prometheus metrics endpoint\n",{"cve":49,"name":5,"tags":51,"capec":53,"model":54,"tools":55,"domain":37,"maxTurns":59,"nist_csf":60,"subdomain":30,"description":7,"mitre_attack":65,"d3fend_techniques":69},[50],"CVE-2022-0492",[28,39,43,38,26,52],"detection",[],"sonnet",[56,35,57,58],"Read","Glob","Grep",20,[61,62,63,64],"PR.PS-01","PR.IR-01","ID.AM-08","DE.CM-01",[66,67,68],"T1059","T1610","T1611",[70,71,72,73,74],"Token Binding","Execution Isolation","File Metadata Consistency Validation","Restore Access","Application Protocol Command Analysis","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fcloud\u002Fkubernetes\u002Fruntime\u002Ffalco\u002Fdetect","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":83,"prompt":93,"zipAvailable":94},[84,87,90],{"tool":85,"command":86},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-runtime-falco-detect",{"tool":88,"command":89},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-runtime-falco-detect",{"tool":91,"command":92},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill kubernetes-runtime-falco-detect","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fruntime\u002Ffalco\u002Fdetect\u002FSKILL.md",true,[96],{"path":97,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"index.json","REFERENCE","参考文档",646,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fkubernetes\u002Fruntime\u002Ffalco\u002Fdetect\u002Findex.json",[103,125,145,166,188,204],{"skillNo":104,"name":105,"nameZh":6,"description":106,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":107,"categories":108,"keywords":109,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[110,27,111,112,113,32,41,114,115,116,117,118,119,120,121,122,123,37,124],"services","services wmi persistence detect","wmi","persistence","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":131,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[132,110,133,112,134,135,136,37,35,34,137,138,139,140,32,31,141,142,143,144],"exploit","services wmi exec exploit","exec","remote","traffic","team","across","crackmapexec","native","lateral movement","read","lateral-movement","Impacket",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":151,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[152,153,154,155,156,157,37,35,158,34,159,160,32,142,161,162,163,164,165,54],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[27,173,174,175,176,177,178,41,179,37,124,180,181,182,183,184,185,186,187,32],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":194,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[195,196,27,197,175,177,198,41,199,179,37,124,34,200,201,202,203,187,32,114],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":205,"name":206,"nameZh":6,"description":207,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":208,"categories":209,"keywords":210,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[211,27,175,212,198,41,213,214,37,124,215,216,217,218,219,220,32,114,221,222],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]