Falco

This analytic detects when a shell is spawned within a Kubernetes container using Falco, potentially indicating unauthorized access, command execution, process manipulation, or privilege escalation, which can lead to data breaches and service disruptions.