Threat Detection in Kubernetes with Falco

Finding out there is "suspicious activity" in your infrastructure is enough to make any DevOps engineer's heart rate spike. If you’re running containerized workloads, you need a way to see exactly what’s happening inside those isolated environments in real-time.

Falco, the open-source standard for cloud-native runtime security. In this guide, we'll walk through a hands-on scenario: investigating a suspicious Nginx container by detecting unauthorized spawning processes.

A team member reports odd behavior in a specific container. Our goal is to use Falco to monitor the execve system call—which is triggered whenever a new process is started—and log those events to a report for analysis.

Step 1: Create a Custom Falco Rule

Falco uses a flexible YAML-based syntax for defining security rules. We need to create a rule specifically targeting our Nginx container.

1. Create a new rules file:
   vi nginx-rules.yml
   


2. Paste the following configuration:
   

- rule: spawned_process_in_nginx_container

  desc: A process was spawned in the Nginx container.

  condition: container.name = "nginx" and evt.type = execve

  output: "%evt.time,%proc.name,%user.uid,%container.id,%container.name,%container.image"

  priority: WARNING

1. Save and exit (Esc, :wq, Enter).

Step 3: Audit the Results

Once the run is complete, you can inspect the log file to see every process that was triggered during that window. This is your "paper trail" for the suspicious activity.

cat /home/cloud_user/falco-report.log