Kube Detection Labs

Open detection content for Kubernetes teams

Each lab covers one threat scenario: what it looks like, why it matters, how to detect it with Falco, how to triage it, and how to fix the underlying condition. All content is free and open.

12 labs published · New labs added regularly
critical T1611 - Escape to Host

LAB-002: Privileged Container Started

A container starts with securityContext.privileged: true. This gives it near-full access to the host kernel. Detect the runtime event and understand how to prevent it from happening again.

Falcoruntime detectionprivilege escalationMITRE T1611
Read lab →
critical T1496 - Resource Hijacking

LAB-003: Cryptominer Process Detected

A known cryptomining binary starts inside a container. The lowest false-positive detection in Kubernetes - and often the first sign that an attacker has gained execution in your cluster.

Falcoruntime detectionimpactMITRE T1496
Read lab →
critical T1059 - Command and Scripting Interpreter

LAB-006: Reverse Shell from a Container

A container opens an outbound connection and pipes it to a shell interpreter. This is one of the clearest signals of active compromise — detect it before the attacker completes their objective.

Falcoruntime detectionexecutionMITRE T1059
Read lab →
critical T1552.007 - Container API

LAB-008: Kubernetes Secret Enumeration

An identity inside the cluster lists or reads Kubernetes Secrets via the API server. Detect it at the audit log level — this is the attack that follows a stolen service account token.

Falcoruntime detectioncredential accessMITRE T1552
Read lab →
critical T1611 - Escape to Host

LAB-012: Container Escape via Host Path Mount

A container has a hostPath volume that gives it access to the host filesystem. Detect the mount at runtime and understand the full escape chain — from container to node to cluster.

Falcoruntime detectionprivilege escalationMITRE T1611
Read lab →
high T1059 - Command and Scripting Interpreter

LAB-001: Shell Spawned Inside a Container

A shell process starts inside a running container. Detect it with Falco, understand why it matters, and know what to do when it fires.

Falcoruntime detectionexecutionMITRE T1059
Read lab →
high T1552 - Unsecured Credentials

LAB-004: Sensitive File Read Inside a Container

A process inside a container reads /etc/shadow, /etc/passwd, or service account tokens. Detect credential access attempts before the attacker uses what they found.

Falcoruntime detectioncredential accessMITRE T1552
Read lab →
high T1609 - Container Administration Command

LAB-005: kubectl exec into a Running Container

Someone ran kubectl exec into a production pod. It might be a developer debugging, or it might be an attacker who stole a kubeconfig. Detect it and know how to tell the difference.

Falcoruntime detectionexecutionMITRE T1609
Read lab →
high T1041 - Exfiltration Over C2 Channel

LAB-007: Data Exfiltration via curl or wget

A container runs curl or wget to send data to an external destination. Detect the exfiltration tool spawning — not just the network connection — and understand what to look for in the egress.

Falcoruntime detectionexfiltrationMITRE T1041
Read lab →
high T1548 - Abuse Elevation Control Mechanism

LAB-009: Privilege Escalation via allowPrivilegeEscalation

A process inside a container gains more privileges than its parent. Detect setuid/setgid execution and understand why allowPrivilegeEscalation: false is not just a checkbox.

Falcoruntime detectionprivilege escalationMITRE T1548
Read lab →
high T1071 - Application Layer Protocol

LAB-011: Unexpected Outbound Network Connection from a Container

A container opens a connection to an external IP or domain it has no business contacting. Detect network anomalies at the syscall level and understand how NetworkPolicy and runtime detection work together.

Falcoruntime detectioncommand and controlMITRE T1071
Read lab →
medium T1525 - Implant Internal Image

LAB-010: Container Running from a Mutable Image Tag

A container starts using :latest or a floating tag. Detect image tag hygiene violations at runtime and understand why this is both a security and reliability risk.

Falcoruntime detectionsupply chainMITRE T1525
Read lab →

Want a tuned detection pack for your cluster?

The Detection Starter Pack includes 10–15 production-ready Falco rules, a severity matrix, triage guide for each detection, and a 2-week rollout plan.

Start by email