<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-container-detection-rules
description: >-
  Implement detection rules for container and Kubernetes environments covering runtime threats, image vulnerabilities, API abuse, and workload anomalies.
domain: cybersecurity
subdomain: detection-engineering
tags:
  - container-security
  - kubernetes
  - runtime-detection
  - pod-security
  - image-scanning
  - k8s-audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Implementing Container Detection Rules

## Overview

Container detection rules address threats in containerized environments
including runtime anomalies, escape attempts, image supply chain attacks,
and Kubernetes API abuse. Covers Falco rules, OPA policies, and k8s audit log analysis.

## Prerequisites

| Requirement | Purpose |
|---|---|
| falco | Container runtime security |
| kubectl | Kubernetes CLI |
| trivy | `apt install trivy` for image scanning |

## Key Concepts

### Falco Container Detection

```yaml
# Falco rule for container escape detection
- rule: Container Escape via Mount Namespace
  desc: >-
    Detects attempts to escape container isolation by accessing
    host filesystem through mount namespace manipulation.
  condition: >-
    spawned_process and container and
    (proc.name in (nsenter, unshare) or
     (proc.name = mount and proc.args contains "/host")) and
    not trusted_container
  output: >-
    Container escape attempt detected
    (user=%user.name command=%proc.cmdline
     container=%container.name image=%container.image.repository
     namespace=%k8s.ns.name pod=%k8s.pod.name)
  priority: CRITICAL
  tags: [container, escape, mitre_privilege_escalation, T1611]
```

## Workflow

1. **Map container threats** — Identify container-specific TTPs and attack vectors
2. **Configure runtime monitoring** — Deploy Falco or equivalent runtime security
3. **Author rules** — Write detection logic for container runtime events
4. **Test in staging** — Validate rules against controlled container scenarios
5. **Integrate k8s audit** — Correlate runtime events with Kubernetes audit logs
6. **Tune for workloads** — Filter legitimate container behavior by namespace and image
7. **Deploy to clusters** — Roll out rules across production Kubernetes clusters

## Detection

```yaml
title: Container Detection Rules Detection
id: 56888926-92d7-4351-9953-709f2e8ef9ef
status: experimental
description: Detects suspicious activity related to implementing container detection rules techniques in detection engineering context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*implementing*container*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.defense_evasion
falsepositives:
  - Detection rule testing in staging SIEM environment
```

## Verification

| Check | Method |
|---|---|
| Workflow completed | All steps executed and documented |
| Output validated | Results match expected format and content |
| Quality assured | Peer review or automated validation passed |

## References

- [NIST Cybersecurity Framework](https://www.nist.gov/cyberframework)
- [MITRE ATT&CK](https://attack.mitre.org/)
