Falco meets MITRE - Run any Falco Installation against Atomic Red
summary
Runs Atomic Red Team attacks as a Kubernetes job against a standard Falco install, using an Ubuntu test image with PowerShell and attacker tools, and triggers dozens of runtime detections. Falco collects syscalls via eBPF kernel probe or module, records user/UID, parent command and container/namespace, and the default rule set flags writes under /etc and /bin, shell execs and privileged containers. Alerts stream into Falco Sidekick UI and map to MITRE ATT&CK techniques, proving the setup catches real behaviors.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:31What is Runtime Security?
- 4:47CNCF Open Source Incubation Project
- 6:57Extending Falco Across the Lifecycle
- 7:40Popular Falco detection rules
- 10:14Falco rule example: access bin directory Event
- 11:09Falco rule: Terminal shell in a container
related talks
23mRuntime K8s Security: Threat Detection with Falcosidekick
41mNavigating the Storm
27mIntro: Falco
36mIntro: Falco
39mKubernetes proactive threat detection with Falco and Prometheus
25mUse Falco and eBPF to protect your applications
54mResponding to security events on Kubernetes, let's build a Security..
39mDeep Dive: Falco