Elastic high stable kql

GKE Pod Exec Potential Reverse Shell

Detects successful GKE pod exec sessions whose command resembles reverse-shell or bind-shell one-liner patterns, including /dev/tcp and /dev/udp redirection, netcat/ncat exec-style flags, socat shell handoff, mkfifo pipelines, and common language socket idioms. Legitimate debug sessions sometimes use similar building blocks, but together these patterns align with post-exploitation interactive access and command-and-control. Common localhost /dev/tcp health-check ports are excluded. GKE records the command in gcp.audit.labels.command.gke.io/command when an explicit command is passed to exec.

View Source

Detection Logic

data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
event.type:start and
event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
gcp.audit.labels.command.gke.io/command:(
  (
    */dev/tcp/* or */dev/udp/* or */inet/tcp/* or
    *0\\\>&1* or
    *IO*Socket*INET* or *TCPSocket.new* or *bash*-i* or *fsockopen* or
    *import*pty* or *import*socket* or *mkfifo* or
    *nc*-c* or *nc*-e* or *netcat*-e* or
    *socat*exec* or *socat*pty* or *socket.socket* or
    *zsh/net/tcp* or *zsh/net/udp*
  ) and not (
    *127.0.0.1* or *localhost*
  )
)

False Positives

⚠ Security training, CTF-style images, or vendor diagnostics may include bash redirection or /dev/tcp examples. Baseline approved images then expand exclusions as needed.

Field Validations

Loading…

Comments (0)

Loading comments...