DevOps · Flashcard
What does Falco's 'Terminal shell in container' rule detect?
- AAn interactive shell started inside a container — a common sign of hands-on-keyboard activity
- BA container image built from a shell base — flagging images that ship with bash installed
- CA shell script stored in a container volume — scanning mounted files for embedded commands
- DA login to the host over SSH — recording administrator sessions on the node itself
Why this is the answer
The rule fires when an interactive shell (e.g. bash) is spawned inside a running container, which often means someone is operating inside it. It is about a runtime exec, not an image's contents at build time, not a scan of stored scripts, and not host SSH logins.
Official docs