Kubernetes Pod Exec & Port Forward Detection

Lacey Cochrane@NullVectorX

•updated Jun 9, 2026•6•0•8

Detects kubectl exec and port-forward operations via the Kubernetes API server. 'Exec' provides interactive shell access to a running container, while 'Port-forward' tunnels into the pod network, potentially bypassing network policies. This rule also detects 'attach' operations.