GKE Pod Exec Potential Reverse Shell

  1[metadata]
  2creation_date = "2026/07/15"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/07/15"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful GKE pod exec sessions whose command resembles reverse-shell or bind-shell one-liner patterns,
 11including /dev/tcp and /dev/udp redirection, netcat/ncat exec-style flags, socat shell handoff, mkfifo pipelines, and
 12common language socket idioms. Legitimate debug sessions sometimes use similar building blocks, but together these
 13patterns align with post-exploitation interactive access and command-and-control. Common localhost /dev/tcp health-check
 14ports are excluded. GKE records the command in gcp.audit.labels.command.gke.io/command when an explicit command is
 15passed to exec.
 16"""
 17false_positives = [
 18    """
 19    Security training, CTF-style images, or vendor diagnostics may include bash redirection or /dev/tcp examples.
 20    Baseline approved images then expand exclusions as needed.
 21    """,
 22]
 23from = "now-6m"
 24index = ["logs-gcp.audit-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "GKE Pod Exec Potential Reverse Shell"
 28note = """## Triage and analysis
 29
 30### Investigating GKE Pod Exec Potential Reverse Shell
 31
 32This alert fires when a successful pods/exec API call includes a command matching reverse/bind-shell idioms.
 33Review `gcp.audit.labels.command.gke.io/command` for the reconstructed payload.
 34
 35### Possible investigation steps
 36
 37- Identify the actor (`client.user.email`), source IP, and user agent (human kubectl vs automation).
 38- Resolve the target namespace and pod from `gcp.audit.resource_name` and correlate with workload ownership.
 39- Hunt nearby events from the same identity: secret reads, pods/exec to other workloads, RoleBinding changes.
 40- Do not replay the command against live infrastructure unless policy explicitly allows a sandboxed recreation.
 41
 42### False positive analysis
 43
 44- Security training or CTF images may include reverse-shell examples; scope exceptions to those namespaces/images.
 45- Some observability or mesh sidecars use socat or sockets in overlapping ways; validate image and command lineage.
 46
 47### Response and remediation
 48
 49- If malicious, terminate the exec session, isolate the workload or node, rotate credentials reachable from the pod,
 50  and revoke pods/exec for the abused principal unless strictly required.
 51"""
 52setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 53references = [
 54    "https://attack.mitre.org/techniques/T1609/",
 55    "https://attack.mitre.org/techniques/T1059/",
 56]
 57risk_score = 73
 58rule_id = "b5974c88-d584-451c-8ce3-6b19d7456199"
 59severity = "high"
 60tags = [
 61    "Domain: Cloud",
 62    "Domain: Kubernetes",
 63    "Data Source: GCP",
 64    "Data Source: GCP Audit Logs",
 65    "Data Source: Google Cloud Platform",
 66    "Use Case: Threat Detection",
 67    "Tactic: Execution",
 68    "Tactic: Command and Control",
 69    "Resources: Investigation Guide",
 70]
 71timestamp_override = "event.ingested"
 72type = "query"
 73
 74query = '''
 75data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 76event.type:start and
 77event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
 78gcp.audit.labels.command.gke.io/command:(
 79  (
 80    */dev/tcp/* or */dev/udp/* or */inet/tcp/* or
 81    *0\\\>&1* or
 82    *IO*Socket*INET* or *TCPSocket.new* or *bash*-i* or *fsockopen* or
 83    *import*pty* or *import*socket* or *mkfifo* or
 84    *nc*-c* or *nc*-e* or *netcat*-e* or
 85    *socat*exec* or *socat*pty* or *socket.socket* or
 86    *zsh/net/tcp* or *zsh/net/udp*
 87  ) and not (
 88    *127.0.0.1* or *localhost*
 89  )
 90)
 91'''
 92
 93[[rule.threat]]
 94framework = "MITRE ATT&CK"
 95
 96[[rule.threat.technique]]
 97id = "T1609"
 98name = "Container Administration Command"
 99reference = "https://attack.mitre.org/techniques/T1609/"
100
101[[rule.threat.technique]]
102id = "T1059"
103name = "Command and Scripting Interpreter"
104reference = "https://attack.mitre.org/techniques/T1059/"
105
106[rule.threat.tactic]
107id = "TA0002"
108name = "Execution"
109reference = "https://attack.mitre.org/tactics/TA0002/"
110
111[[rule.threat]]
112framework = "MITRE ATT&CK"
113
114[[rule.threat.technique]]
115id = "T1095"
116name = "Non-Application Layer Protocol"
117reference = "https://attack.mitre.org/techniques/T1095/"
118
119[rule.threat.tactic]
120id = "TA0011"
121name = "Command and Control"
122reference = "https://attack.mitre.org/tactics/TA0011/"
123
124[rule.investigation_fields]
125field_names = [
126    "@timestamp",
127    "client.user.email",
128    "source.ip",
129    "user_agent.original",
130    "event.action",
131    "event.outcome",
132    "event.type",
133    "gcp.audit.labels.command.gke.io/command",
134    "gcp.audit.resource_name",
135    "data_stream.namespace",
136]