Bypassing Falco: How to Compromise a Cluster without Tripping the SOC
summary
Claims nine bypass classes (seven novel) against Falco v0.30.0 detections and implements them end to end using kernel sensors and userland tricks. Techniques include symlink/time‑of‑check evasion, hard links, proc.name/proc.exe renaming and fake ancestor chains, regex/argument subtitution to defeat grep/netcat rules, and mount path subdirectories. A public BlackBerry image and snippets automate attacks that go from a webshell to docker socket and kubelet token to create a nodePort miner, producing only two alerts in the demo.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:13Container security overview
- 2:00Falco architecture and rules
- 4:13Previous work on bypasses
- 5:28Symlink and hardlink evasion
- 8:00Privilege escalation rule
- 9:34Process name evasion
- 13:10Reverse shell detection
- 14:53Argument and key bypasses
- 16:57Toolbox and setup
- 18:53Scenario one demonstration
- 22:18Scenario two demonstration
- 24:41Bypassing scenario two
- 28:08Final attack evasion
- 32:06Fixes and recommendations
related talks
36mBypass Falco
34mThe Eye of Falco: You Can Escape but Not Hide
41mNavigating the Storm
34mHow Clusters Fail Under Attack and How We Detect It at Runtime with eBPF signals
23mRuntime K8s Security: Threat Detection with Falcosidekick
25mUse Falco and eBPF to protect your applications
30mEvasive Maneuvers: Strategies to Overcome Runtime Detection Tools
45mThe Container Escape Room: An Exploration of Container Escapes