Senior LevelDocker & Deployment
How does Falco analyze kernel syscalls to detect runtime container security breaches?
❓ Interview Prompt: Explain Falco eBPF syscall interception, rule language, MITRE ATT&CK detection, and integration with SIEM for runtime threat detection.
Falco is a cloud-native runtime security tool (CNCF) that uses Linux kernel syscall interception to detect anomalous container behavior in real-time.
How Falco Works:
1
Syscall Interception: Falco taps into the Linux kernel's system calls via:
•
Kernel Module: Older approach — custom kernel driver.
•
eBPF Probe (modern): BPF CO-RE program — safer, no kernel module, works across kernel versions.
2
Event Parsing: Raw syscalls (open, execve, connect, write) are parsed into structured events.
3
Rule Evaluation: Events are matched against a library of security rules written in a YAML-like rule language.
4
Alerting: Rule violations are sent to stdout, syslog, Slack, Falcosidekick (webhook router to SIEM, PagerDuty, etc.).
Critical Default Rules (MITRE ATT&CK Coverage):
•
T1059 (Command Execution): Shell spawned in a container that shouldn't have shells.
•
T1048 (Exfiltration): Unexpected outbound network connections from containers.
•
T1098 (Privilege Escalation): Container running as root writing to sensitive paths.
•
T1543 (Persistence): New binary written to /etc, /bin, /sbin at runtime.
•
T1070 (Log Tampering):
/var/log/auth.log modified.Code Implementation Example
yaml
# Custom Falco rule: detect shell spawned in NGINX container
- rule: Shell Spawned in NGINX Container
desc: >
A shell was spawned inside an NGINX container. NGINX should never
need a shell — this is likely a breakout attempt or compromise.
condition: >
spawned_process
and container.image.repository contains "nginx"
and proc.name in (shell_binaries)
output: >
CRITICAL Shell spawned in NGINX container
(user=%user.name container=%container.name
image=%container.image.repository
command=%proc.cmdline parent=%proc.pname)
priority: CRITICAL
tags: [container, shell, MITRE_T1059]
---
# Falcosidekick: route Falco alerts to Slack + PagerDuty
# helm install falcosidekick falcosecurity/falcosidekick \
# --set config.slack.webhookurl="https://hooks.slack.com/..."
# --set config.pagerduty.routingKey="..."
# --set config.alertmanager.hostport="http://alertmanager:9093"💡Falco rule detects shell execution inside NGINX containers — alerts via Falcosidekick to Slack + PagerDuty immediately.
🎯 Interview Key Takeaway
Falco intercepts Linux syscalls via eBPF to detect real-time breaches: unexpected shells, privilege escalation, network exfiltration — maps to MITRE ATT&CK framework. Route alerts via Falcosidekick.
#Falco#Runtime Security#eBPF#MITRE ATT&CK#SIEM#Senior
Back to all Docker & Deployment Questions→