Interactive K8s Shell Execution in Production Namespaces

Danny Y@zendannyy

•updated Feb 18, 2026•1•0•35

The following detects interactive shell execution within a container in a production K8s namespace. This could be indicative of an attacker with a compromised user account attempting to control a container.