detecting-container-drift-at-runtime

Deploy Falco with rules that flag spawned processes where proc.is_exe_upper_layer is true, indicating a binary not present in the original image. Complement this with rules for shell spawns, package manager execution, and unexpected file writes to the container filesystem.

A rule matching spawned_process and container with proc.is_exe_upper_layer = true detects binaries written to the overlay upper layer. Add a second rule matching proc.name in (bash, sh, dash, zsh) to catch interactive shells spawned outside the container entrypoint.

No. Writable volumeMounts such as /tmp or cache directories remain legitimate write targets where attackers can stage payloads. Combine readOnlyRootFilesystem with Falco file-write rules and digest verification for broader coverage.

Rules based on proc.is_exe_upper_layer only catch binaries written to the overlay upper layer. Payloads executed via memfd_create or from emptyDir/tmpfs mounts run from different layers, so add proc.cmdline content matching for interpreters like python -c or node -e.

Exec into a test pod with kubectl, download a payload with curl, make it executable, and run it. Confirm the Drift Detected and Container Shell Spawned rules emit alerts, then repeat with the binary dropped into a mounted emptyDir to verify the known coverage gap.

Yes. Microsoft Defender for Containers provides built-in binary drift detection with the K8S.NODE_ImageBinaryDrift alert type, which fires when a binary not part of the original image executes and includes remediation steps like enabling readOnlyRootFilesystem.