If you’re just starting out with Falco or cloud threat detection:
Which type of detection rule would you build first? 
A) Kubernetes exec into container
B) Suspicious network outbound
C) File change to critical path
D) Other (comment below) 
D) Terminal shell in container.
This would allow detection of interactive sessions via kube exec, and RCE > shell in the event of workload compromise. If someone is actively interacting with my containers I want to know!
Interested to hear what everyone else thinks!
2 Likes
B) No one comes in without wanting to send something out.
1 Like
A) Kubernetes exec into container
It would provide immediate value in understanding runtime visibility! With this, one can quickly distinguish between legitimate and suspicious exec patterns.
1 Like
A) Kubernetes exec into container
It looks like a small thing but it’s a good way to identify patterns and best (or bad) practices!
1 Like
D) Known malicious IOCs like for malware and cryptominers. Simple enough to get your feet wet, but effective 
1 Like