mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-22 20:51:01 +03:00
mukul975
27c6414ca5
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
1.6 KiB
1.6 KiB
name, description
| name | description |
|---|---|
| performing-cloud-native-forensics-with-falco | Uses Falco YAML rules for runtime threat detection in containers and Kubernetes, monitoring syscalls for shell spawns, file tampering, network anomalies, and privilege escalation. Manages Falco rules via the Falco gRPC API and parses Falco alert output. Use when building container runtime security or investigating k8s cluster compromises. |
Performing Cloud Native Forensics with Falco
Instructions
Deploy and manage Falco rules for runtime security detection in containerized environments. Parse Falco alerts for incident response.
# Custom Falco rule for detecting shell in container
- rule: Shell Spawned in Container
desc: Detect shell process started in a container
condition: >
spawned_process and container
and proc.name in (bash, sh, zsh, dash, csh)
and not proc.pname in (docker-entrypo, supervisord)
output: >
Shell spawned in container
(user=%user.name command=%proc.cmdline container=%container.name
image=%container.image.repository)
priority: WARNING
tags: [container, shell, mitre_execution]
Key detection rules:
- Shell spawn in non-interactive containers
- Sensitive file access (/etc/shadow, /etc/passwd)
- Outbound connections from unexpected containers
- Privilege escalation via setuid/setgid
- Container escape via mount or ptrace
Examples
# Run Falco with custom rules
falco -r /etc/falco/custom_rules.yaml -o json_output=true
# Parse JSON alerts
cat /var/log/falco/alerts.json | python3 -c "import json,sys; [print(json.loads(l)['output']) for l in sys.stdin]"