Vendors / Falco / Falco / Falco terminal shell in container

Event type

Falco terminal shell in container

Published Critical terminal-shell profile with registry sensor/workload identities and exact integer nanosecond timestamps.

JSON 22 fields Generator

falco container runtime shell

Preview Sample View Schema

CLI Install

meltr templates install falco

Overview

What this event covers

Published JSON output-channel example profile; fixed rule, command, priority and tags. Requires source-specific entities: entities/falco/falco/runtime-alert.yaml; example configuration: configs/falco/falco/runtime-alert.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›A shell is spawned in a container with an attached terminal.

Security relevance

Informational

Frequency notes

One event/second local test rate; five-event burst. Independent alerts, no container lifecycle simulation.

Resources

Docs and tools

Falco JSON output example official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

hostname

String Optional

Hostname of `registry.get_random_device()`, selected once.

Source: Hostname of `registry.get_random_device()`, selected once.

Example falco-sensor-02

output

String Optional

Exact published message structure, rebuilt from the same structured field dictionary, UTC clock and priority. Pod, command, identity, tty and both container-ID appearances agree.

Source: Exact published message structure, rebuilt from the same structured field dictionary, UTC clock and priority. Pod, command, identity, tty and both container-ID appearances agree.

Example

22:48:02.761855503: Critical A shell was spawned in a container with an attached terminal (user=root user_loginuid=-1 k8s.ns=default k8s.pod=example-shell-02 container=454e61a0dab0 shell=sh parent=runc cmdline=sh -c clear; (bash || ash || sh) terminal=34816 container_id=454e61a0dab0 image=docker.io/library/alpine)

priority

String Optional

Fixed `Critical`.

Source: Fixed `Critical`.

Example Critical

rule

String Optional

Fixed `Terminal shell in container`.

Source: Fixed `Terminal shell in container`.

Example Terminal shell in container

source

String Optional

Fixed `syscall`.

Source: Fixed `syscall`.

Example syscall

tags

Array Optional

Fixed ordered list: `container`, `mitre_execution`, `shell`.

Source: Fixed ordered list: `container`, `mitre_execution`, `shell`.

Example ["container","mitre_execution","shell"]

time

String Optional

UTC ISO timestamp with nine fractional digits from the single event clock and synthetic submicrosecond fraction.

Source: UTC ISO timestamp with nine fractional digits from the single event clock and synthetic submicrosecond fraction.

Example 2026-10-01T22:48:02.761855503Z

output_fields

Object Optional

Contains exactly the fields below; no additional properties.

Source: Contains exactly the fields below; no additional properties.

Example

{"container.id":"454e61a0dab0","container.image.repository":"docker.io/library/alpine","evt.time":1790894882761855503,"k8s.ns.name":"default","k8s.pod.name":"example-shell-02","proc.cmdline":"sh -c clear; (bash || ash || sh)","proc.name":"sh","proc.pname":"runc","proc.tty":34816,"user.loginuid":-1,"user.name":"root"}

output_fields.container.id

String Optional

Stable mapped service `falco_container_id`; twelve lowercase hex characters in this local profile.

Source: Stable mapped service `falco_container_id`; twelve lowercase hex characters in this local profile.

Example 454e61a0dab0

output_fields.container.image.repository

String Optional

Fixed `docker.io/library/alpine`.

Source: Fixed `docker.io/library/alpine`.

Example docker.io/library/alpine

output_fields.evt.time

Integer Optional

Exact Unix nanoseconds derived using integer day/second arithmetic plus the same fraction as `time` and `output`.

Source: Exact Unix nanoseconds derived using integer day/second arithmetic plus the same fraction as `time` and `output`.

Example 1790894882761855503

output_fields.k8s.ns.name

String Optional

Fixed `default`.

Source: Fixed `default`.

Example default

output_fields.k8s.pod.name

String Optional

Same mapped service's `falco_pod_name`.

Source: Same mapped service's `falco_pod_name`.

Example example-shell-02

output_fields.proc.cmdline

String Optional

Fixed `sh -c clear; (bash || ash || sh)`.

Source: Fixed `sh -c clear; (bash || ash || sh)`.

Example sh -c clear; (bash || ash || sh)

output_fields.proc.name

String Optional

Fixed `sh`.

Source: Fixed `sh`.

Example sh

output_fields.proc.pname

String Optional

Fixed `runc`.

Source: Fixed `runc`.

Example runc

output_fields.proc.tty

Integer Optional

Fixed `34816`.

Source: Fixed `34816`.

Example 34816

output_fields.user.loginuid

Integer Optional

Fixed `-1` sentinel; never replaced with an unrelated registry user ID.

Source: Fixed `-1` sentinel; never replaced with an unrelated registry user ID.

Example -1

output_fields.user.name

String Optional

Fixed `root`.

Source: Fixed `root`.

Example root

tags[0]

String Optional

Fixed ordered list: `container`, `mitre_execution`, `shell`. This field is the tags[0] member.

Source: Fixed ordered list: `container`, `mitre_execution`, `shell`.

Example container

tags[1]

String Optional

Fixed ordered list: `container`, `mitre_execution`, `shell`. This field is the tags[1] member.

Source: Fixed ordered list: `container`, `mitre_execution`, `shell`.

Example mitre_execution

tags[2]

String Optional

Fixed ordered list: `container`, `mitre_execution`, `shell`. This field is the tags[2] member.

Source: Fixed ordered list: `container`, `mitre_execution`, `shell`.

Example shell