GKE Pod Exec Potential Reverse Shell

IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

GKE Pod Exec Potential Reverse Shell

Detects successful GKE pod exec sessions whose command resembles reverse-shell or bind-shell one-liner patterns, including /dev/tcp and /dev/udp redirection, netcat/ncat exec-style flags, socat shell handoff, mkfifo pipelines, and common language socket idioms. Legitimate debug sessions sometimes use similar building blocks, but together these patterns align with post-exploitation interactive access and command-and-control. Common localhost /dev/tcp health-check ports are excluded. GKE records the command in gcp.audit.labels.command.gke.io/command when an explicit command is passed to exec.

Rule type: query

Rule indices:

logs-gcp.audit-*

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-6m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

Domain: Cloud
Domain: Kubernetes
Data Source: GCP
Data Source: GCP Audit Logs
Data Source: Google Cloud Platform
Use Case: Threat Detection
Tactic: Execution
Tactic: Command and Control
Resources: Investigation Guide

Version: 1

Rule authors:

Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating GKE Pod Exec Potential Reverse Shell

This alert fires when a successful pods/exec API call includes a command matching reverse/bind-shell idioms. Review gcp.audit.labels.command.gke.io/command for the reconstructed payload.

Possible investigation steps

Identify the actor (client.user.email), source IP, and user agent (human kubectl vs automation).
Resolve the target namespace and pod from gcp.audit.resource_name and correlate with workload ownership.
Hunt nearby events from the same identity: secret reads, pods/exec to other workloads, RoleBinding changes.
Do not replay the command against live infrastructure unless policy explicitly allows a sandboxed recreation.

False positive analysis

Security training or CTF images may include reverse-shell examples; scope exceptions to those namespaces/images.
Some observability or mesh sidecars use socat or sockets in overlapping ways; validate image and command lineage.

Response and remediation

If malicious, terminate the exec session, isolate the workload or node, rotate credentials reachable from the pod, and revoke pods/exec for the abused principal unless strictly required.

Setup

edit

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

Rule query

edit

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.type:start and
event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
gcp.audit.labels.command.gke.io/command:(
  (
    */dev/tcp/* or */dev/udp/* or */inet/tcp/* or
    *0\\\>&1* or
    *IO*Socket*INET* or *TCPSocket.new* or *bash*-i* or *fsockopen* or
    *import*pty* or *import*socket* or *mkfifo* or
    *nc*-c* or *nc*-e* or *netcat*-e* or
    *socat*exec* or *socat*pty* or *socket.socket* or
    *zsh/net/tcp* or *zsh/net/udp*
  ) and not (
    *127.0.0.1* or *localhost*
  )
)

Framework: MITRE ATT&CK^TM

Tactic:
- Name: Execution
- ID: TA0002
- Reference URL: https://attack.mitre.org/tactics/TA0002/
Technique:
- Name: Container Administration Command
- ID: T1609
- Reference URL: https://attack.mitre.org/techniques/T1609/
Technique:
- Name: Command and Scripting Interpreter
- ID: T1059
- Reference URL: https://attack.mitre.org/techniques/T1059/
Tactic:
- Name: Command and Control
- ID: TA0011
- Reference URL: https://attack.mitre.org/tactics/TA0011/
Technique:
- Name: Non-Application Layer Protocol
- ID: T1095
- Reference URL: https://attack.mitre.org/techniques/T1095/

« GKE Pod Exec with Curl or Wget to HTTPS GKE CoreDNS or Kube-DNS Configuration Modified »