Techniques
Sample rules
GKE Pod Exec Potential Reverse Shell
- source: elastic
- technicques:
- T1059
- T1095
- T1609
Description
Detects successful GKE pod exec sessions whose command resembles reverse-shell or bind-shell one-liner patterns, including /dev/tcp and /dev/udp redirection, netcat/ncat exec-style flags, socat shell handoff, mkfifo pipelines, and common language socket idioms. Legitimate debug sessions sometimes use similar building blocks, but together these patterns align with post-exploitation interactive access and command-and-control. Common localhost /dev/tcp health-check ports are excluded. GKE records the command in gcp.audit.labels.command.gke.io/command when an explicit command is passed to exec.
Detection logic
data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.type:start and
event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
gcp.audit.labels.command.gke.io/command:(
(
*/dev/tcp/* or */dev/udp/* or */inet/tcp/* or
*0\\\>&1* or
*IO*Socket*INET* or *TCPSocket.new* or *bash*-i* or *fsockopen* or
*import*pty* or *import*socket* or *mkfifo* or
*nc*-c* or *nc*-e* or *netcat*-e* or
*socat*exec* or *socat*pty* or *socket.socket* or
*zsh/net/tcp* or *zsh/net/udp*
) and not (
*127.0.0.1* or *localhost*
)
)