detecting-container-escape-attempts
mukul975/Anthropic-Cybersecurity-Skills
Detects container escape attempts at runtime by monitoring namespace manipulation, capability abuse, kernel exploits, sensitive mounts, and anomalous syscalls. Explains which signals matter for Falco, Sysdig, auditd, or EDR collection. Use when investigating suspected Docker/Kubernetes breakouts or comparing runtime sensor coverage.