GKE Pod Exec Potential Reverse Shell

  1[metadata]
  2creation_date = "2026/07/15"
  3integration = ["gcp"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Detects successful GKE pod exec sessions whose command resembles reverse-shell or bind-shell one-liner patterns,
 11including /dev/tcp and /dev/udp redirection, netcat/ncat exec-style flags, socat shell handoff, mkfifo pipelines, and
 12common language socket idioms. Legitimate debug sessions sometimes use similar building blocks, but together these
 13patterns align with post-exploitation interactive access and command-and-control. Common localhost /dev/tcp health-check
 14ports are excluded. GKE records the command in gcp.audit.labels.command.gke.io/command when an explicit command is
 15passed to exec.
 16"""
 17false_positives = [
 18    """
 19    Security training, CTF-style images, or vendor diagnostics may include bash redirection or /dev/tcp examples.
 20    Baseline approved images then expand exclusions as needed.
 21    """,
 22]
 23from = "now-6m"
 24index = ["logs-gcp.audit-*"]
 25language = "kuery"
 26license = "Elastic License v2"
 27name = "GKE Pod Exec Potential Reverse Shell"
 28note = """## Triage and analysis
 29
 30### Investigating GKE Pod Exec Potential Reverse Shell
 31
 32This alert fires when a successful pods/exec API call includes a command matching reverse/bind-shell idioms.
 33Review `gcp.audit.labels.command.gke.io/command` for the reconstructed payload.
 34
 35### Possible investigation steps
 36
 37- Identify the actor (`client.user.email`), source IP, and user agent (human kubectl vs automation).
 38- Resolve the target namespace and pod from `gcp.audit.resource_name` and correlate with workload ownership.
 39- Hunt nearby events from the same identity: secret reads, pods/exec to other workloads, RoleBinding changes.
 40- Do not replay the command against live infrastructure unless policy explicitly allows a sandboxed recreation.
 41
 42### False positive analysis
 43
 44- Security training or CTF images may include reverse-shell examples; scope exceptions to those namespaces/images.
 45- Some observability or mesh sidecars use socat or sockets in overlapping ways; validate image and command lineage.
 46
 47### Response and remediation
 48
 49- If malicious, terminate the exec session, isolate the workload or node, rotate credentials reachable from the pod,
 50  and revoke pods/exec for the abused principal unless strictly required.
 51"""
 52setup = "The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule."
 53references = [
 54    "https://attack.mitre.org/techniques/T1609/",
 55    "https://attack.mitre.org/techniques/T1059/",
 56]
 57risk_score = 73
 58rule_id = "b5974c88-d584-451c-8ce3-6b19d7456199"
 59severity = "high"
 60tags = [
 61    "Domain: Cloud",
 62    "Domain: Kubernetes",
 63    "Data Source: GCP",
 64    "Data Source: Google Cloud Platform",
 65    "Data Source: GCP Audit Logs",
 66    "Use Case: Threat Detection",
 67    "Tactic: Execution",
 68    "Tactic: Command and Control",
 69    "Resources: Investigation Guide",
 70    "Noise: Medium",
 71    "Performance: Normal",
 72    "Profile: Recommended",
 73    "Threat: Reverse Shell",
 74    "Rule Type: Custom Query (KQL)",
 75    "Platform: GCP",
 76    "Domain: Containers",
 77    "Platform: Kubernetes",
 78]
 79timestamp_override = "event.ingested"
 80type = "query"
 81
 82query = '''
 83data_stream.dataset:gcp.audit and service.name:"k8s.io" and event.outcome:success and
 84event.type:start and
 85event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
 86gcp.audit.labels.command.gke.io/command:(
 87  (
 88    */dev/tcp/* or */dev/udp/* or */inet/tcp/* or
 89    *0\\\>&1* or
 90    *IO*Socket*INET* or *TCPSocket.new* or *bash*-i* or *fsockopen* or
 91    *import*pty* or *import*socket* or *mkfifo* or
 92    *nc*-c* or *nc*-e* or *netcat*-e* or
 93    *socat*exec* or *socat*pty* or *socket.socket* or
 94    *zsh/net/tcp* or *zsh/net/udp*
 95  ) and not (
 96    *127.0.0.1* or *localhost*
 97  )
 98)
 99'''
100
101[[rule.threat]]
102framework = "MITRE ATT&CK"
103
104[[rule.threat.technique]]
105id = "T1609"
106name = "Container Administration Command"
107reference = "https://attack.mitre.org/techniques/T1609/"
108
109[[rule.threat.technique]]
110id = "T1059"
111name = "Command and Scripting Interpreter"
112reference = "https://attack.mitre.org/techniques/T1059/"
113
114[rule.threat.tactic]
115id = "TA0002"
116name = "Execution"
117reference = "https://attack.mitre.org/tactics/TA0002/"
118
119[[rule.threat]]
120framework = "MITRE ATT&CK"
121
122[[rule.threat.technique]]
123id = "T1095"
124name = "Non-Application Layer Protocol"
125reference = "https://attack.mitre.org/techniques/T1095/"
126
127[rule.threat.tactic]
128id = "TA0011"
129name = "Command and Control"
130reference = "https://attack.mitre.org/tactics/TA0011/"
131
132[rule.investigation_fields]
133field_names = [
134    "@timestamp",
135    "client.user.email",
136    "source.ip",
137    "user_agent.original",
138    "event.action",
139    "event.outcome",
140    "event.type",
141    "gcp.audit.labels.command.gke.io/command",
142    "gcp.audit.resource_name",
143    "data_stream.namespace",
144]