What does Falco's 'Terminal shell in container' rule detect?

Why this is the answer

The rule fires when an interactive shell (e.g. bash) is spawned inside a running container, which often means someone is operating inside it. It is about a runtime exec, not an image's contents at build time, not a scan of stored scripts, and not host SSH logins.