Skip to content
Threat Feed

Tag

Reverse_shell

1 brief RSS
high advisory

Kubernetes Pod Exec Potential Reverse Shell Activity Detected

This rule flags potential reverse shell activity via kubectl exec commands in Kubernetes pods by detecting specific shell and socket idioms within URL-decoded command payloads in Kubernetes audit logs, indicating post-exploitation interactive access and command-and-control.

Kubernetes reverse_shell execution command_and_control
3r 2t