Direct Access to Container Environment Variables

gaurang k@gaurang7778

•updated Sep 1, 2026•0•0•2

This rule detects common command-line utilities (cat, bash, sh, python, grep) being used to access the '/proc/1/environ' file. This file contains environment variables for the PID 1 process (typically the init system), which may include sensitive information such as credentials, configuration paths, or system secrets.