基于Falco实现运行时入侵检测

rpm --import https://falco.org/repo/falcosecurity-packages.asccurl -s -o /etc/yum.repos.d/falcosecurity.repo https://falco.org/repo/falcosecurity-rpm.repoyum update -yyum install -y falco # 执行命令测试Falco是否安装成功,若失败，尝试执行 falcoctl driver install 下载预编译驱动

sudo systemctl list-unit-files "falco*"# 启用eBPFsudo systemctl enable falco-modern-bpf.service#启用falco-modern-bpf.service还会falco-custom.service创建一个名为 的新别名/服务，sudo systemctl list-unit-files "falco*"#启动服务systemctl start falco-modern-bpf.servicesystemctl status falco-modern-bpf.service

syslog_output:     #关闭默认输出  enable: false   stdout_output:      #关闭默认输出  enable: falsefile_output:      #输出到一个指定的日志文件中。  enable: true  keep_alive：false  filename: /var/log/falco.log

more /etc/shadow     tail -f /var/log/falco.log

- rule: Apache spawns bash shell (Web Attack Alert)  desc: “检测 Apache 进程异常启动 Bash，可能为 Web 漏洞利用（如反弹 Shell、远程命令执行）”  condition: evt.type=execve and container.id!=host and proc.pname=apache2 and proc.name="bash"  output: High risk process behavior in container, Apache spawns bash shell (evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags %container.info)  priority: critical  tags: [container, shell]

helm repo add falcosecurity https://falcosecurity.github.io/chartshelm repo update

helm install --replace falco --namespace falco --create-namespace --set tty=true falcosecurity/falco

kubectl get pods -n falco

kubectl run pod1 --image=nginxkubectl exec -it pod1 -- cat /etc/shadow

kubectl logs -l app.kubernetes.io/name=falco -n falco -c falco | grep Warning

helm upgrade --namespace falco falco falcosecurity/falco --set falcosidekick.enabled=true --set falcosidekick.webui.enabled=true

kubectl -n falco get svc