<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-runtime-application-protection
description: >-
  Deploy Runtime Application Self-Protection (RASP) and runtime security monitoring
  using Falco, eBPF-based tools, and application-level security middleware. Detect
  and block attacks at runtime including injection, deserialization, and anomalous
  behavior in production environments.
domain: cybersecurity
subdomain: devsecops
tags:
  - rasp
  - runtime-security
  - falco
  - ebpf
  - waf
  - application-monitoring
  - anomaly-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190"]
---

# Implementing Runtime Application Protection

## Overview

Runtime Application Self-Protection (RASP) and runtime monitoring detect attacks that
bypass pre-deployment security controls. Falco monitors system calls for anomalous
container behavior, eBPF provides kernel-level observability, and application-level
middleware blocks injection and deserialization attacks in real time.

Mode: `[MODE: BLUE]` — Runtime threat detection and automated response.

## Prerequisites

| Requirement | Details |
|---|---|
| Falco (`helm install falco falcosecurity/falco`) | Required |
| Kubernetes cluster with eBPF support | Required |
| Application security middleware (language-specific) | Required |
| Logging infrastructure (ELK, Splunk, or CloudWatch) | Required |

## Key Concepts

### Falco Runtime Detection

```yaml
# Custom Falco rules
- rule: Detect Shell in Container
  desc: Alert when a shell is spawned inside a container
  condition: >
    spawned_process and container and
    proc.name in (bash, sh, zsh, dash) and
    not proc.pname in (cron, supervisord)
  output: >
    Shell spawned in container
    (user=%user.name container=%container.name shell=%proc.name
     parent=%proc.pname cmdline=%proc.cmdline image=%container.image.repository)
  priority: WARNING
  tags: [container, shell, mitre_execution, T1059]

- rule: Detect Cryptominer
  desc: Detect cryptocurrency mining processes
  condition: >
    spawned_process and container and
    (proc.name in (xmrig, minerd, cpuminer, cgminer) or
     proc.cmdline contains "stratum+tcp")
  output: >
    Cryptominer detected (user=%user.name container=%container.name
     proc=%proc.name cmdline=%proc.cmdline)
  priority: CRITICAL
  tags: [container, cryptominer, mitre_impact, T1496]

- rule: Sensitive File Access
  desc: Detect access to sensitive files
  condition: >
    open_read and container and
    fd.name in (/etc/shadow, /etc/passwd, /proc/self/environ)
  output: >
    Sensitive file read (file=%fd.name user=%user.name container=%container.name)
  priority: WARNING
  tags: [container, filesystem, mitre_credential_access, T1552]
```

### Falco Deployment (Helm)

```bash
# Install Falco with eBPF
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco \
  --namespace falco --create-namespace \
  --set driver.kind=ebpf \
  --set falcosidekick.enabled=true \
  --set falcosidekick.config.slack.webhookurl="https://hooks.slack.com/..." \
  --set falcosidekick.config.slack.minimumpriority=warning

# Install with custom rules
helm install falco falcosecurity/falco \
  --namespace falco --create-namespace \
  --set-file customRules."custom-rules\.yaml"=custom-rules.yaml
```

### Application-Level RASP (Python)

```python
# middleware/security.py — RASP middleware for Flask/FastAPI
import re
from functools import wraps

SQLI_PATTERNS = [
    re.compile(r"(?i)(?:union\s+select|or\s+1\s*=\s*1|'\s*or\s*'|;\s*drop\s+table)", re.IGNORECASE),
    re.compile(r"(?i)(?:exec\s*\(|xp_cmdshell|sp_executesql)", re.IGNORECASE),
]

XSS_PATTERNS = [
    re.compile(r"<script[^>]*>", re.IGNORECASE),
    re.compile(r"(?:on\w+\s*=\s*[\"']|javascript\s*:)", re.IGNORECASE),
]

PATH_TRAVERSAL = re.compile(r"(?:\.\./|\.\.\\|%2e%2e[%/])", re.IGNORECASE)


def rasp_protect(func):
    """RASP decorator — blocks injection attacks at runtime."""
    @wraps(func)
    def wrapper(*args, **kwargs):
        from flask import request, abort
        # Check all request parameters
        params = request.args.to_dict() | (request.json or {})
        for key, value in params.items():
            val_str = str(value)
            for pattern in SQLI_PATTERNS:
                if pattern.search(val_str):
                    abort(403, f"Blocked: SQL injection attempt in {key}")
            for pattern in XSS_PATTERNS:
                if pattern.search(val_str):
                    abort(403, f"Blocked: XSS attempt in {key}")
            if PATH_TRAVERSAL.search(val_str):
                abort(403, f"Blocked: Path traversal attempt in {key}")
        return func(*args, **kwargs)
    return wrapper
```

### Kubernetes Network Policies

```yaml
# Restrict pod network access
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-egress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: web
  policyTypes:
    - Egress
  egress:
    - to:
        - podSelector:
            matchLabels:
              app: api
      ports:
        - port: 8080
    - to:
        - namespaceSelector:
            matchLabels:
              name: kube-system
      ports:
        - port: 53
          protocol: UDP
```

### Runtime Alerting Pipeline

```yaml
# Falco → Falcosidekick → Slack/PagerDuty/SIEM
# falcosidekick config
config:
  slack:
    webhookurl: "https://hooks.slack.com/services/..."
    minimumpriority: "warning"
  elasticsearch:
    hostport: "https://elasticsearch:9200"
    index: "falco"
  pagerduty:
    routingkey: "..."
    minimumpriority: "critical"
```

## Workflow

### Step 1: Check Runtime Security Posture

```bash
node scripts/agent.js --action audit --namespace production --output /tmp/runtime-audit.json
```

### Step 2: Validate Falco Rules

```bash
node scripts/agent.js --action validate-rules --rules-file custom-rules.yaml --output /tmp/rules-check.json
```

### Step 3: Test RASP Patterns

```bash
node scripts/agent.js --action test-patterns --output /tmp/rasp-test.json
```

## Detection

```yaml
title: Runtime Application Protection Detection
id: 9ad54a7b-7546-4197-86e1-0b476e412bea
status: experimental
description: Detects suspicious activity related to implementing runtime application protection techniques in devsecops context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*implementing*runtime*"
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.execution
falsepositives:
  - CI/CD pipeline executing authorized security scanning tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Runtime Application Protection Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1190 |

## Verification

- [ ] Falco deployed with eBPF driver on all nodes
- [ ] Custom rules detect shell access, crypto miners, sensitive file reads
- [ ] Alerting pipeline sends critical events to incident response
- [ ] Application RASP middleware blocks injection attempts
- [ ] Network policies restrict pod-to-pod communication
- [ ] Runtime logs forwarded to SIEM for correlation
- [ ] Automated response playbooks trigger on critical alerts

## References

- [Falco Documentation](https://falco.org/docs/)
- [Falcosidekick](https://github.com/falcosecurity/falcosidekick)
- [Kubernetes Network Policies](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
- [OWASP RASP](https://owasp.org/www-community/Runtime_Application_Self-Protection)
