Falco pour K8s managés — shells inattendus / changements de privilèges

Hardening alerts only — no attack recipes. Falco is a CNCF-graduated runtime security engine commonly used on Kubernetes to alert on suspicious syscalls and behaviors. For managed K8s MSP fleets, prioritize rules that flag unexpected shells in containers, sensitive mount abuse, and privilege / capability changes — then route alerts into on-call with customer context and isolation playbooks.

Operational pattern: deploy Falco (or managed equivalent) with a minimal high-signal ruleset; suppress noisy namespaces intentionally; ticket every CRITICAL with pod/node/tenant tags; pair with network policies and admission controls. Do not publish detection-bypass techniques in customer runbooks.

Goal: shorten mean-time-to-triage when a managed cluster shows interactive shells or priv escalation indicators — defensive monitoring, not offensive testing guides.

FAQ

Quels signaux prioriser ?

Shells interactifs inattendus dans les pods app, changements de privilèges/capabilities et accès hostPath sensibles — selon le baseline client.

Comment router les alertes ?

Vers on-call/ITSM avec cluster, namespace, tenant et identité pod ; exiger contain/triage avant clôture.

Sources

• GitHub — falcosecurity/falco
• Falco documentation

Draft only — do not publish without editorial review.