SSRF Local File Read of /proc/self/environ and /var/task/ in GCP Cloud Run Container

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects unauthorized or suspicious processes accessing sensitive files within the Linux /proc filesystem or application-specific directories (such as graph_api.py, main.py, or requirements.txt). By excluding standard administrative tools like systemd, rpm, dpkg, and apt, this rule highlights processes that may be performing reconnaissance, credential harvesting, or attempting to read source code in an abnormal manner.