---
title: GKE User Exec into Pod
description: Detects the first occurrence of a non-system GKE identity establishing an exec session into a pod. kubectl exec enables interactive command execution...
url: https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/gcp/execution_gcp_gke_user_exec_into_pod
products:
  - Elastic Security
---

# GKE User Exec into Pod
Detects the first occurrence of a non-system GKE identity establishing an exec session into a pod. kubectl exec enables
interactive command execution inside workloads and is a common post-compromise technique to access secrets and expand
access.
**Rule type**: new_terms
**Rule indices**:
- logs-gcp.audit-*

**Rule Severity**: medium
**Risk Score**: 47
**Runs every**: 
**Searches indices from**: `now-6m`
**Maximum alerts per execution**: 100
**References**:
- [[https://kubernetes.io/docs/tasks/debug/debug-application/get-shell-running-container/](https://kubernetes.io/docs/tasks/debug/debug-application/get-shell-running-container/)](https://kubernetes.io/docs/tasks/debug/debug-application/get-shell-running-container/)

**Tags**:
- Domain: Cloud
- Domain: Kubernetes
- Data Source: GCP
- Data Source: Google Cloud Platform
- Use Case: Threat Detection
- Tactic: Execution
- Resources: Investigation Guide
- Noise: Low
- Performance: Fast
- Rule Type: New Terms
- Platform: GCP
- Domain: Containers
- Platform: Kubernetes

**Version**: 2
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Investigation guide


## Triage and analysis


### Investigating GKE User Exec into Pod

This new-terms rule alerts on the first exec into a given pod by a user identity in the lookback window.

### Investigation steps

- Review `user.email`, `orchestrator.resource.name`, `source.ip`, and `user_agent.original`.
- Determine whether the target pod holds sensitive data or cluster credentials.
- Correlate with secret access or RBAC changes from the same identity.


### False positives

- Approved admin debugging; exclude stable operator identities after review.


## Setup

The GCP Fleet integration with GKE audit logs enabled is required to be compatible with this rule.

## Rule Query

```kuery
data_stream.dataset:gcp.audit and event.action:("io.k8s.core.v1.pods.exec.create" or "io.k8s.core.v1.pods.exec.get") and
not user.email:system\:*
```

**Framework:** MITRE ATT&CK
- Tactic:
  - Name: Execution
  - Id: TA0002
  - Reference URL: [[https://attack.mitre.org/tactics/TA0002/](https://attack.mitre.org/tactics/TA0002/)](https://attack.mitre.org/tactics/TA0002/)
- Technique:
  - Name: Container Administration Command
  - Id: T1609
  - Reference URL: [[https://attack.mitre.org/techniques/T1609/](https://attack.mitre.org/techniques/T1609/)](https://attack.mitre.org/techniques/T1609/)