GCP Cloud Run Local File Read of /proc/self/environ for Service Account Token Theft
Detects access to sensitive GCP credential-related files or the presence of credential-related environment variables/secrets in command lines and network request bodies. This pattern is often associated with the theft of service account keys or environment-based cloud credentials, frequently seen in serverless or containerized environments.
Cortex XDR
