CME-1003

Falco / eBPF Runtime Security

Detect OS/Kernel Unquantified evidence Detective

Description

Kernel-level runtime security using eBPF or kernel modules to detect anomalous behavior: unexpected shell spawns, sensitive file reads, network connections from unusual processes.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Compensating control: exploit post-exploitation behavior triggers alerts

Verification

Verify Falco is running with rules loaded

$ systemctl is-active falco
# Expected: active

Platform: linux

$ falco --list 2>/dev/null | head -5
# Expected: rule names

Platform: linux

Remediation

linux Falco eBPF runtime security installation and configuration


rpm --import https://falco.org/repo/falcosecurity-packages.asc && curl -s -o /etc/yum.repos.d/falcosecurity.repo https://falco.org/repo/falcosecurity-rpm.repo && dnf install -y falco
falcoctl driver install --type modern_ebpf
systemctl enable --now falco-modern-bpf