Skip to content

Instantly share code, notes, and snippets.

@githubfoam

githubfoam/falco detection cheat sheet

Created May 29, 2025 12:03
Show Gist options
  • Save githubfoam/464e9d6d8aea0ebc052854ffab025aa0 to your computer and use it in GitHub Desktop.
Save githubfoam/464e9d6d8aea0ebc052854ffab025aa0 to your computer and use it in GitHub Desktop.
Download ZIP
falco detection cheat sheet
Raw
falco detection cheat sheet
#======================================================================
Simulated Detection Scenarios
Falco – Chmod 777
Scenario: Attacker gives full permissions to a sensitive file.
Simulate:
touch /tmp/test.sh && chmod 777 /tmp/test.sh
Falco Alert:
Detected chmod 777 (user=root file=/tmp/test.sh)
#======================================================================
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment