skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

detecting-container-escape-with-falco-rules

Detect container escape attempts using Falco runtime security rules monitoring syscalls and file access.

954|172|Updated Mar 13, 2026
Search Tags:#kubernetes#detection#detection rules#falco#runtime security#container escape#syscall monitoring
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill detecting-container-escape-with-falco-rules
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: detecting-container-escape-with-falco-rules
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/container-security/detecting-container-escape-with-falco-rules
Command: npx skills add https://github.com/xalgord/xalgorix --skill detecting-container-escape-with-falco-rules

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Container escape attacks let adversaries break out of isolated containers to compromise the host, and standard monitoring often misses these syscall-level techniques. This Skill provides ready-to-deploy Falco rules that detect escape attempts in real time, including namespace escapes, cgroup release_agent writes, privileged container launches, and Docker socket abuse.

Core Features & Use Cases

  • Eight Detection Rules: Covers host filesystem mounts, nsenter execution, privileged containers, sysrq-trigger writes, kernel module loading, cgroup release_agent writes (CVE-2022-0492), /etc/shadow reads, and Docker socket access, each tagged with MITRE ATT&CK technique IDs.
  • Deployment Guidance: Includes Helm-based Kubernetes installation with eBPF driver, standalone Debian/Ubuntu setup, Falco configuration, and Slack alerting via Falcosidekick.
  • Detection Gap Analysis: Documents known bypasses such as renamed binaries defeating proc.name matching and unreliable container.privileged fields, with validation steps to confirm rules fire.
  • Use Case: A SOC analyst hardening a Kubernetes cluster deploys Falco as a DaemonSet, loads the custom container-escape rules file, runs the provided test pods to validate CRITICAL alerts, and forwards findings to Slack for triage.

Quick Start

Deploy Falco to my Kubernetes cluster with Helm and load the custom container escape detection rules, then verify alerts fire using the test pods.

Frequently Asked Questions about detecting-container-escape-with-falco-rules

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect container escape attempts in Kubernetes?▼

Deploy Falco as a DaemonSet with Helm using the eBPF driver, then load custom rules that monitor for nsenter execution, host filesystem mounts, cgroup release_agent writes, and Docker socket access. Validate coverage by running test pods that trigger each rule and checking Falco logs for CRITICAL alerts.

What Falco rules detect privilege escalation in containers?▼

Key rules include detecting privileged container launches via container.privileged=true, writes to /proc/sysrq-trigger, kernel module loading with insmod or modprobe, and reads of /etc/shadow. Corroborate privileged detection with container.cap_effective for SYS_ADMIN since the privileged field is unreliable under some containerd versions.

Does Falco work with containerd and standalone Docker?▼

Yes, Falco supports Kubernetes with containerd by enabling the containerd collector socket in Helm values, and it also installs standalone on Debian/Ubuntu via the official apt repository. Both setups require kernel 5.8+ for the eBPF driver or kernel module support.

Why do Falco container escape rules miss some attacks?▼

Rules matching proc.name like nsenter or mount are bypassed by renaming binaries, static linking, or invoking raw setns/unshare syscalls directly. Prefer evt.type syscall conditions over process name matching, and add rules for cgroup mounts to catch namespace-escape variants.

How do I forward Falco alerts to Slack?▼

Enable Falcosidekick during Helm installation and configure the Slack webhook URL with a minimum priority in its values file. Falco's http_output setting sends JSON alerts to Falcosidekick, which formats and forwards them to your Slack channel.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

detecting-privilege-escalation-in-kubernetes-pods

Audit Kubernetes pod security contexts and generate privilege escalation reports.

Community
Advanced
afoxnyc3afoxnyc3

incident-response

Triage Azure Defender alerts and correlate sign-in logs into incident timelines.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

kyverno-pod-security-templates

Enforce Kyverno Pod Security Standards with YAML policies and compliance reports.

Official
Advanced
lapc506lapc506
4

Container Security

Scan container images with Trivy, monitor runtime with Falco, and sign images with Notary.

Community
Advanced