WTF, My Container Just Spawned a Shell
summary
Sysdig Falco is an open source runtime monitor that hooks kernel tracepoints to capture system calls plus container metadata and match them against user rules. It detects surprising events like a spawned bash shell, writes a pre-alert capture (the demo shows ~5,500 syscalls) and can trigger actions in the orchestrator to kill container or snapshot for forensics. The commercial layer, Sysdig Secure, adds rule editing, automated stops and post‑mortem reconstruction of modified binaries and downloaded rootkits, and it integrates with Mesos.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:05Container security challenges
- 2:33Static vs runtime security
- 6:14How Falco works
- 13:25Live demo of Falco
- 19:21Sysdig Secure introduction
- 24:27Detecting shells in containers
- 30:58Forensic analysis with Inspect
- 36:52Falco community and future
- 37:34Q&A
related talks
08mSysdig Sponsored Session
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter
39mCSI Container: Can You DFIR It?
29mDetecting cloud and container threats
28mSecurity Kill Chain Stages in a 100k+ Daily Container Environment with Falco
36mIntro: Falco
27mIntro: Falco
41mNavigating the Storm