GCP Cloud Run LFR: /proc/self/environ and source code exfiltration

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•6

This rule detects potential exfiltration attempts from a GCP Cloud Run container by monitoring for outbound network connections triggered by processes reading sensitive local files. The files being monitored include environment variable configurations (/proc/self/environ) and application source code, which may contain credentials or service account tokens.