Falco low stable other

Debugfs Launched in Privileged Container

Detect file system debugger debugfs launched inside a privileged container which might lead to container escape. This rule has a more narrow scope.

View Source

Detection Logic

spawned_process and container and container.privileged=true and proc.name=debugfs

Field Validations

Loading…

Comments (0)

Loading comments...