This rule detects successful GKE Pod Exec API calls where the executed command indicates data exfiltration or tooling download via HTTPS. It inspects the command captured in gcp.audit.labels.command.gke.io/command for curl or wget invocations that fetch an HTTPS URL. Benign health checks and common Kubernetes endpoints (e.g., healthz, readyz, jwks, OpenID configurations, and localhost patterns) are explicitly excluded to reduce noise. The detection uses GCP Audit Logs (gcp.audit) and targets events where event.type is start and event.action corresponds to pods.exec.create or pods.exec.get, ensuring the exec session actually started. When a match is found, the rule highlights the command, target resource (gcp.audit.resource_name), and the identity and source of the session for rapid triage. The technique maps to MITRE ATT&CK T1609 (Container Administration Command) and T1105 (Ingress Tool Transfer). Typical interventions include revoking compromised credentials, reviewing and tightening RBAC for pods/exec in sensitive namespaces, and scanning the pod for artifacts or data exfiltration paths. This rule is designed to help detect tooling downloads or staging that could precede further compromise within a GKE cluster, particularly when an attacker uses exec to reach external HTTPS resources from within a containerized workload.