GCP Container /proc/environ Exfil by Web Process with External Network

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.