GCP Cloud Run local file read exfiltration via /app/ or /var/task/ path in url parameter

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects potentially malicious HTTP requests targeted at Google Cloud Run services that attempt to access restricted or internal application paths, such as '/app/' or '/var/task/'. These patterns often indicate attempts to probe for or exploit vulnerable web application files, internal scripts, or configuration files (e.g., 'graph_api.py', 'graph.zip') commonly found in serverless environments.