用 Falco 规则检测容器逃逸：Anthropic-Cybersecurity-Skills 实战工作流指南

用 Falco 规则检测容器逃逸Anthropic-Cybersecurity-Skills 实战工作流指南【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills本指南基于开源仓库 Anthropic-Cybersecurity-Skills 中detecting-container-escape-with-falco-rules技能包系统讲解如何在 Kubernetes 环境中通过 Falco 规则实时检测容器逃逸Container Escape。你将掌握从 Falco 部署、自定义逃逸检测规则编写、攻击模拟测试、告警集成到误报调优的完整工作流并理解每条规则背后的 syscall 级检测原理与 MITRE ATTCK 映射。工作流总览容器逃逸是攻击者突破容器隔离边界、获取宿主机权限的关键一步。Falco 是 CNCF 毕业的运行时安全工具通过内核驱动的 syscall 监控来识别异常容器行为——包括挂载宿主文件系统、访问敏感宿主路径、加载内核模块、滥用特权容器能力等。检测到逃逸行为意味着容器运行时隔离已被突破是安全事件响应中的最高优先级告警。围绕本技能包中的 workflows.md完整的检测工作流分为五个阶段阶段目标关键操作Phase 1部署 FalcoHelm 安装 DaemonSet eBPF 驱动 FalcosidekickPhase 2部署自定义逃逸规则ConfigMap 挂载规则、重启加载、验证规则生效Phase 3测试检测特权容器、敏感文件访问、shell 生成三类攻击模拟Phase 4告警集成Falcosidekick 对接 Slack / Elasticsearch / PrometheusPhase 5调优与维护误报例外、规则更新、逃逸模拟演练Phase 1部署 FalcoKubernetes Helm 安装工作流要求在 Kubernetes 集群上以 DaemonSet 形式部署 Falco确保每个节点都有覆盖。核心命令如下helm repo add falcosecurity https://falcosecurity.github.io/charts helm repo update helm install falco falcosecurity/falco \ --namespace falco --create-namespace \ --set driver.kindebpf \ --set falcosidekick.enabledtrue \ --set falcosidekick.webui.enabledtrue \ --set collectors.containerd.enabledtrue kubectl -n falco rollout status daemonset/falco --timeout120s几个关键参数的作用需要说明driver.kindebpf使用 eBPF 驱动而非内核模块部署更安全、无内核版本升级导致的模块重编译问题。前提是 Linux 内核 5.8eBPF 驱动支持或具备内核模块加载能力详见 SKILL.md 的前置条件说明。falcosidekick.enabledtrue启用告警转发组件这是 Phase 4 告警集成的基础。collectors.containerd.enabledtrue采集 containerd 的容器元数据用于在告警中关联容器 ID、镜像等信息。验证部署kubectl get pods -n falco -o wide kubectl logs -n falco -l app.kubernetes.io/namefalco --tail10仓库中的配套脚本还提供了更结构化的健康检查手段。scripts/process.py 中的check_falco_health()通过kubectl get pods -n falco -l app.kubernetes.io/namefalco -o json遍历所有 Pod仅当全部处于Running状态时才判定集群健康并输出每个 Pod 所在节点——这比肉眼查看日志更适合批量巡检python scripts/process.py health独立主机安装备选非 Kubernetes 场景standalone Docker/containerd可走 Debian/Ubuntu 软件源安装curl -fsSL https://falco.org/repo/falcosecurity-packages.asc | \ sudo gpg --dearmor -o /usr/share/keyrings/falco-archive-keyring.gpg echo deb [signed-by/usr/share/keyrings/falco-archive-keyring.gpg] https://download.falco.org/packages/deb stable main | \ sudo tee /etc/apt/sources.list.d/falcosecurity.list sudo apt-get update sudo apt-get install -y falco sudo systemctl enable falco sudo systemctl start falcoPhase 2部署自定义逃逸检测规则通过 ConfigMap 加载规则Falco 自带规则集覆盖常见逃逸面但本工作流要求针对逃逸场景补充自定义规则。标准做法是用 ConfigMap 挂载规则文件kubectl create configmap falco-escape-rules -n falco \ --from-filecontainer-escape.yaml/path/to/container-escape.yaml # Restart Falco to load new rules kubectl rollout restart daemonset/falco -n falco配套脚本 scripts/process.py 提供了deploy子命令可自动完成「生成规则 → 构建 ConfigMap → kubectl apply → 提示重启」的全流程python scripts/process.py deploy --namespace falco验证规则加载kubectl exec -n falco $(kubectl get pod -n falco -l app.kubernetes.io/namefalco -o jsonpath{.items[0].metadata.name}) -- \ falco --list | grep -i escape如果配置了rules_files指向自定义规则文件这里应看到规则名。除--list外api-reference.md 还建议在部署前用以下 CLI 做语法与字段校验falco --version # 检查版本 falco --validate /path/to/rules.yaml # 校验规则语法 falco -r /etc/falco/rules.d/escape.yaml # 加载指定规则 falco --list # 列出全部可用字段 falco --list-events # 列出支持的 syscall脚本 scripts/agent.py 的validate_rules_file()正是封装了falco --validate可直接用于 CI 门禁python scripts/agent.py --validate-rules /etc/falco/rules.d/escape.yaml逃逸检测规则集深度解析工作流 Phase 2 涉及的规则文件核心检测逻辑在 SKILL.md 中有完整 8 条规则的 YAML 定义按逃逸向量分述如下。规则 1宿主文件系统挂载- rule: Container Mounting Host Filesystem desc: Detect a container attempting to mount the host filesystem condition: spawned_process and container and proc.name mount and (proc.args contains /host or proc.args contains nsenter) output: Container mounting host filesystem (user%user.name container_id%container.id container_name%container.name image%container.image.repository command%proc.cmdline %evt.args) priority: CRITICAL tags: [container, escape, T1611]规则 2nsenter 命名空间逃逸- rule: Nsenter Execution in Container desc: Detect nsenter being used to escape container namespaces condition: spawned_process and container and proc.name nsenter output: nsenter executed in container - potential escape attempt (user%user.name container_id%container.id image%container.image.repository command%proc.cmdline parent%proc.pname) priority: CRITICAL tags: [container, escape, namespace, T1611]规则 3特权容器启动- rule: Launch Privileged Container desc: Detect a privileged container being launched condition: container_started and container and container.privilegedtrue output: Privileged container started (user%user.name container_id%container.id container_name%container.name image%container.image.repository) priority: WARNING tags: [container, privileged, T1610]规则 4/proc/sysrq-trigger 写入- rule: Write to Sysrq Trigger desc: Detect writes to /proc/sysrq-trigger which can crash or control the host condition: open_write and container and fd.name /proc/sysrq-trigger output: Write to /proc/sysrq-trigger from container (user%user.name container_id%container.id image%container.image.repository command%proc.cmdline) priority: CRITICAL tags: [container, escape, host-manipulation]规则 5内核模块加载- rule: Container Loading Kernel Module desc: Detect a container attempting to load a kernel module condition: spawned_process and container and (proc.name in (insmod, modprobe) or (proc.name init_module)) output: Kernel module loading from container (user%user.name container_id%container.id image%container.image.repository command%proc.cmdline) priority: CRITICAL tags: [container, escape, kernel, T1611]规则 6cgroup release_agent 逃逸CVE-2022-0492- rule: Write to Cgroup Release Agent desc: Detect writes to cgroup release_agent which is a known container escape vector condition: open_write and container and fd.name endswith release_agent output: Container writing to cgroup release_agent - escape attempt (user%user.name container_id%container.id image%container.image.repository file%fd.name command%proc.cmdline) priority: CRITICAL tags: [container, escape, cgroup, CVE-2022-0492]规则 7宿主 /etc/shadow 读取凭据窃取- rule: Container Reading Host Shadow File desc: Detect a container reading /etc/shadow on the host via mounted volume condition: open_read and container and (fd.name /etc/shadow or fd.name startswith /host/etc/shadow) output: Container reading host shadow file (user%user.name container_id%container.id image%container.image.repository file%fd.name command%proc.cmdline) priority: CRITICAL tags: [container, credential-access, T1003]规则 8Docker Socket 访问- rule: Container Accessing Docker Socket desc: Detect a container accessing the Docker socket which allows host control condition: (open_read or open_write) and container and fd.name /var/run/docker.sock output: Container accessing Docker socket (user%user.name container_id%container.id image%container.image.repository command%proc.cmdline) priority: CRITICAL tags: [container, escape, docker-socket, T1610]规则语法与字段速查规则遵循统一的 YAML 结构api-reference.md 给出的完整语法骨架为- rule: name desc: description condition: filter expression output: alert message with fields priority: Emergency|Alert|Critical|Error|Warning|Notice|Informational|Debug tags: [tag1, tag2] enabled: true条件表达式依赖的关键过滤字段如下完整列表可运行falco --list获取字段含义container事件是否来自容器spawned_process是否产生新进程proc.name进程名proc.cmdline完整命令行proc.pname父进程名fd.name文件描述符路径container.name容器名container.image.repository镜像仓库名container.privileged是否特权容器proc.is_exe_upper_layer二进制是否不在原始镜像中evt.typesyscall 类型setns、unshare、mount 等聚合规则集SKILL.md 还提供了一个聚合版本部署到/etc/falco/rules.d/container-escape.yaml。它先用list定义逃逸二进制清单再用macro封装公共条件避免每条规则重复编写- list: escape_binaries items: [nsenter, chroot, unshare, mount, umount, pivot_root] - macro: container_escape_attempt condition: spawned_process and container and proc.name in (escape_binaries) - rule: Container Escape Binary Execution desc: Detect execution of binaries commonly used for container escape condition: container_escape_attempt output: Escape-related binary executed in container (user%user.name container%container.name image%container.image.repository command%proc.cmdline parent%proc.pname pid%proc.pid) priority: CRITICAL tags: [container, escape, mitre_T1611] - rule: Sensitive File Access from Container desc: Detect container access to sensitive host files condition: (open_read or open_write) and container and (fd.name startswith /proc/1/ or fd.name /etc/shadow or fd.name /etc/kubernetes/admin.conf or fd.name startswith /var/lib/kubelet/) output: Sensitive file accessed from container (container%container.name image%container.image.repository file%fd.name command%proc.cmdline user%user.name) priority: CRITICAL tags: [container, sensitive-file, mitre_T1005]注意escape_binaries中同时监控了chroot、pivot_root等镜像逃逸关键二进制第二条规则覆盖/proc/1/、/etc/kubernetes/admin.conf、/var/lib/kubelet/等 k8s 场景特有的敏感路径。这些规则模板与 scripts/process.py 中ESCAPE_RULES字典完全对应脚本执行python scripts/process.py generate即可一键输出完整规则文件。Phase 3测试检测效果部署完成后必须实际验证规则能命中工作流提供了三类由轻到重的攻击模拟。测试 1特权容器kubectl run escape-test-priv --imagealpine --restartNever \ --overrides{spec:{containers:[{name:test,image:alpine,command:[sleep,30],securityContext:{privileged:true}}]}} # Check alert kubectl logs -n falco -l app.kubernetes.io/namefalco --tail5 | grep -i privileged kubectl delete pod escape-test-priv对应规则 3container.privilegedtrue告警优先级 WARNING映射 T1610 Deploy Container。测试 2敏感文件访问kubectl run escape-test-shadow --imagealpine --restartNever -- cat /etc/shadow kubectl logs -n falco -l app.kubernetes.io/namefalco --tail5 | grep -i shadow kubectl delete pod escape-test-shadow对应规则 7宿主 shadow 文件读取映射 T1003 OS Credential Dumping。测试 3Shell 生成kubectl exec -it deploy/some-app -- /bin/sh # 在 Falco 日志中应看到 Terminal shell in container这是检测攻击者在容器内获取交互式 shell 的行为。SKILL.md 还补充了 nsenter 逃逸的测试方式SKILL.md# Simulate nsenter kubectl run test-nsenter --imagealpine --restartNever --overrides{spec:{hostPID:true}} -- nsenter -t 1 -m -u -i -n -- cat /etc/hostname # Check Falco alerts kubectl logs -n falco -l app.kubernetes.io/namefalco --tail50 | grep -i escape告警输出默认是纯文本。若希望直接解析需在 falco.yaml 中开启 JSON 输出然后交给仓库脚本处理。脚本 scripts/process.py 的parse-alerts子命令会按规则、优先级聚合并单独挑出带escape/T1611/T1610标签的逃逸告警python scripts/process.py parse-alerts --log-file /var/log/falco/events.jsonJSON 告警的标准结构见 api-reference.md{ time: 2024-01-15T10:30:00.000Z, rule: Container Escape Binary Execution, priority: Critical, source: syscall, output: Escape binary in container..., output_fields: { user.name: root, proc.cmdline: nsenter -t 1 -m -u -i -n, container.name: attacker-pod }, tags: [container, escape, T1611] }scripts/agent.py 的parse_falco_alerts()支持--min-priority按严重级别过滤其SEVERITY_MAP定义了 Emergency→Debug 的数字映射并复用同一套逃逸标签集合做归类python scripts/agent.py --parse-alerts /var/log/falco/events.json --min-priority WarningPhase 4集成告警通知配置 Falcosidekick 输出裸 Falco 日志难以在第一时间触达值守人员工作流通过 Falcosidekick 将告警多路转发到 Slack、Elasticsearch 与 Prometheus# values-sidekick.yaml config: slack: webhookurl: https://hooks.slack.com/services/XXX/YYY/ZZZ minimumpriority: warning elasticsearch: hostport: https://elasticsearch:9200 index: falco minimumpriority: notice prometheus: enabled: truehelm upgrade falco falcosecurity/falco -n falco \ -f values-sidekick.yaml各输出的作用与配置要点slackminimumpriority: warning保证 CRITICAL/WARNING 告警即时推送更精细的告警模板可参考 SKILL.md 中通过messageformat提取container_name、container_image_repository、proc_cmdline的示例。elasticsearchindex: falco指定落库索引便于 SIEM 检索与溯源。prometheus暴露 Falco 指标端点是 Phase 5 健康监控的基础。Falco 自身的http_output配置SKILL.md也需指向 Falcosidekick 端口http_output: enabled: true url: http://falcosidekick:2801 insecure: truePhase 5调优与维护误报处理逃逸规则是典型的「宁可错杀不可放过」型检测误报不可避免。工作流给出的标准做法是为已知合法行为追加例外workflows.md- rule: Terminal shell in container append: true exceptions: - name: known_shell_spawners fields: [container.image.repository] comps: [in] values: - [my-debug-image, kubectl-debug]要点用append: true在原规则上追加例外按镜像仓库白名单豁免调试镜像。建议先在permissive只记录不阻断模式下运行观察再逐步收紧。更完整的误报治理可结合 assets/template.md 的「False Positive Exceptions」登记表记录镜像、规则、豁免理由、审批人与日期形成可审计的例外清单。常规维护节奏每周更新规则falcoctl artifact install falco-rules评审新规则每个 Falco 版本发布后审查新增的maturity_stable规则。规则成熟度分级见 standards.mdmaturity_stable生产可用、低误报→maturity_incubating可能需要调优→maturity_sandbox实验性、误报高→maturity_deprecated待移除关联审计将 Falco 告警与 Kubernetes audit logs 关联还原完整攻击链月度演练每月执行逃逸模拟演练确保规则与人员都保持活性。告警分诊与升级逃逸告警应纳入明确的分诊流程。assets/template.md 提供的 Runbook 模板给出标准动作0-5 分钟确认告警并定位 Pod/节点5-30 分钟抓取 Pod 规格、检查 security context、特权标志、宿主机路径挂载并对照 Kubernetes audit logs确认逃逸后执行隔离network policy deny-all、kubectl cordon node、采集取证数据、删除容器并复查同节点其他 Pod恢复阶段扫描 rootkit、必要时重建节点。升级矩阵assets/template.md优先级响应时间通知对象CRITICAL立即安全 On-Call 工程负责人WARNING15 分钟安全 On-CallNOTICE1 小时安全团队队列INFO次日每日站会评审检测覆盖与标准映射逃逸检测规则并非孤立存在本技能包在 standards.md 中将其与多个权威框架对齐便于 SOC 评估覆盖度MITRE ATTCK 技术名称对应 Falco 检测T1611Escape to Hostnsenter、mount、chroot 检测T1610Deploy Container特权容器启动检测T1003OS Credential Dumping容器内读取 /etc/shadowT1005Data from Local System敏感文件读取检测T1059Command and Scripting Interpreter容器内 shell 生成T1068Exploitation for Privilege Escalation内核漏洞利用指标仓库的 ATTACK_COVERAGE.md 与 mappings/attack-navigator-layer.json 也记录了该项目覆盖 T1611/T1610 等逃逸技术可将本技能包的规则直接纳入全局检测覆盖视图。同时逃逸检测与以下已知 CVE 强相关standards.mdCVE-2024-21626runc process.cwd 逃逸检测 /proc/self/fd 访问宿主、CVE-2022-0492cgroup v1 release_agent对应规则 6、CVE-2022-0185文件系统上下文利用检测容器内 unshare、CVE-2020-15257containerd-shim API检测抽象 socket 连接、CVE-2019-5736runc 覆盖宿主二进制检测写入 /proc/self/exe。小结本工作流给出了一条从部署到运营的完整逃逸检测闭环以 eBPF 驱动的 Falco DaemonSet 铺满集群用 ConfigMap 装载针对 8 大逃逸向量的自定义规则通过特权容器、敏感文件、shell 生成、nsenter 等攻击模拟验证规则有效性经 Falcosidekick 把告警接入 Slack/Elasticsearch/Prometheus最后以例外追加和月度演练保持规则低误报、高活性。仓库配套的 agent.py 与 process.py 脚本将「生成规则 → 校验 → 部署 → 解析告警 → 健康巡检」自动化可直接接入日常运营与 CI 流程。【免费下载链接】Anthropic-Cybersecurity-Skills817 structured cybersecurity skills for AI agents · Mapped to 6 frameworks: MITRE ATTCK, NIST CSF 2.0, MITRE ATLAS, D3FEND, NIST AI RMF MITRE F3 (Fight Fraud) · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI 20 platforms · 29 security domains · Apache 2.0项目地址: https://gitcode.com/GitHub_Trending/an/Anthropic-Cybersecurity-Skills创作声明：本文部分内容由AI辅助生成（AIGC），仅供参考