Falco: Runtime Threat Detection for Kubernetes

What Is Falco?

Falco detects unexpected behavior in running containers by monitoring Linux syscalls. Think of it as an intrusion detection system (IDS) for Kubernetes. CNCF Graduated, 7K+ stars.

What Falco Detects

• Shell spawned inside container
• Sensitive file read (/etc/shadow, /etc/passwd)
• Unexpected network connections
• Binary executed from /tmp
• Privilege escalation attempts
• Container escape techniques
• Cryptominer signatures

Installation

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
  --namespace falco --create-namespace \
  --set driver.kind=modern_ebpf \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.slack.webhookurl="https://hooks.slack.com/..."

Default Rules (Out of the Box)

Falco ships with 100+ rules covering common threats:

# Shell in container
- rule: Terminal shell in container
  desc: A shell was spawned in a container
  condition: >
    spawned_process and container and shell_procs
    and not known_shell_spawn_containers
  output: >
    Shell spawned in container
    (container=%container.name shell=%proc.name parent=%proc.pname
     user=%user.name evt_type=%evt.type)
  priority: WARNING
  tags: [container, shell, mitre_execution]

Custom Rules

# Detect crypto mining
- rule: Detect crypto miners
  desc: Detected a process with crypto mining indicators
  condition: >
    spawned_process and container and
    (proc.name in (xmrig, minerd, cpuminer) or
     proc.cmdline contains "stratum+tcp" or
     proc.cmdline contains "pool.minergate")
  output: >
    Crypto miner detected (container=%container.name cmd=%proc.cmdline)
  priority: CRITICAL
  tags: [cryptomining, mitre_resource_hijacking]

# Detect kubectl exec
- rule: Kubectl exec to pod
  desc: Someone ran kubectl exec into a production pod
  condition: >
    spawned_process and container and
    k8s.ns.name = "production" and
    proc.pname = "runc"
  output: >
    Exec into production pod (pod=%k8s.pod.name ns=%k8s.ns.name user=%ka.user.name)
  priority: WARNING
  tags: [k8s, exec, mitre_execution]

MITRE ATT&CK Mapping

Alert Pipeline

Syscall → Falco Engine → Rule Match → Falcosidekick → Destinations
                                                        ├── Slack
                                                        ├── PagerDuty
                                                        ├── Elasticsearch
                                                        ├── AWS SecurityHub
                                                        ├── Prometheus
                                                        └── OPA (auto-kill pod)

Response Automation

# Falcosidekick + Kubernetes Response Engine
# Auto-kill pod on critical alert
apiVersion: v1
kind: ConfigMap
metadata:
  name: falcosidekick-config
data:
  config.yaml: |
    kubernetesPolicyReport:
      enabled: true
    # Kill pod on critical
    outputs:
      - type: kubernetesPod
        config:
          action: delete
          minimumPriority: critical

Performance Impact

Modern eBPF driver adds negligible overhead — production-safe.

Related Articles

• Cilium: eBPF Security
• Keycloak: IAM
• OWASP Top 10 for LLM Applications