Kubectl Exec into Pod for Command Execution

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to execute commands within a Kubernetes pod using `kubectl exec`. It specifically looks for HTTP requests to port 8080 (often used by Kubernetes API servers or proxies) with URIs containing both '/exec' and 'pods', indicating an interactive command execution session within a pod.