K8S-CUSTOM-DETECTIONS

Summary from the TLDR InfoSec newsletter

k8s-custom-detections provides a curated collection of Falco detection rules, audit policies, and reproducible attack scripts for identifying real-world Kubernetes attack techniques, including RBAC abuse, service account token theft, CoreDNS manipulation, etcd unauthorized access, and certificate forgery. The repository includes ready-to-deploy lab setup scripts for Ubuntu 24.04 with Helm-based Falco integration and individual test scenarios that simulate attacker behavior against each detection category. Useful for security teams building Kubernetes runtime detection capabilities or validating existing monitoring coverage against common cluster compromise techniques.