<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-container-runtime-threats
description: >-
  Analyze container runtime threats using Falco, Tetragon, and sysdig to detect
  anomalous process execution, file access, network connections, and syscall
  patterns in running containers across Docker and Kubernetes environments.
domain: cybersecurity
subdomain: container-security
tags:
  - runtime-security
  - falco
  - tetragon
  - sysdig
  - ebpf
  - syscall-monitoring
  - anomaly-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1610"]
---

# Analyzing Container Runtime Threats

## Overview

Runtime threat analysis monitors container behavior after deployment to detect
malicious activity that bypasses pre-deployment scanning. This skill covers
deploying and tuning Falco rules, Cilium Tetragon eBPF policies, and sysdig
filters for detecting cryptominers, reverse shells, lateral movement, data
exfiltration, and anomalous syscall patterns in production containers.

Mode: `[MODE: BLUE]` — Runtime detection and threat analysis.

## Prerequisites

| Requirement | Details |
|---|---|
| Falco >= 0.37 deployed as DaemonSet or systemd service | Required |
| Cilium Tetragon >= 1.0 (optional, for eBPF-based enforcement) | Required |
| Sysdig OSS for deep syscall inspection | Required |
| Container runtime | containerd or CRI-O |
| Linux kernel >= 5.8 for eBPF features | Required |

## Key Concepts

### Core Techniques

Refer to the parent container-security skill for detailed command references and
attack/defense techniques relevant to this area.

```bash
# Run the automated audit agent
node scripts/agent.js --action audit --output /tmp/analyzing-container-runtime-threats-audit.json
```

### Automation

The `scripts/agent.js` tool provides automated scanning and analysis capabilities.
See `references/api-reference.md` for complete tool and API documentation.

## Workflow

### Step 1: Collect Data

```bash
node scripts/agent.js --action audit --output /tmp/analyzing-container-runtime-threats-results.json
```

### Step 2: Review Findings

```bash
cat /tmp/analyzing-container-runtime-threats-results.json | jq '.findings[] | select(.severity == "critical" or .severity == "high")'
```

### Step 3: Remediate

Address findings by severity, starting with critical items. Re-run the audit
to verify remediation effectiveness.

## Detection

```yaml
title: Container Runtime Threats Detection
id: 6cfba1be-ec9e-4f01-a855-0bfd0a18d040
status: experimental
description: Detects suspicious activity related to analyzing container runtime threats techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1610
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Container Runtime Threats Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1610 |

## Verification

- [ ] Automated scan completed with zero critical findings
- [ ] All high-severity findings have remediation plans
- [ ] Configuration changes validated in staging before production
- [ ] Detection rules deployed and alerting verified
- [ ] Documentation updated with current security posture

## References

- [Falco Documentation](https://falco.org/docs/)
- [Cilium Tetragon](https://tetragon.io/docs/)
- [Sysdig OSS](https://github.com/draios/sysdig)
- [MITRE ATT&CK Containers Matrix](https://attack.mitre.org/matrices/enterprise/containers/)
