Detects successful GKE pods/exec API sessions where the command resembles reverse-shell or bind-shell one-liners. The rule inspects the reconstructed payload in gcp.audit.labels.command.gke.io/command and flags patterns such as /dev/tcp and /dev/udp redirection, netcat/ncat execution, socat shell handoff, mkfifo pipelines, and common language socket idioms (e.g., IO.Socket, socket.socket, zsh/net/tcp). It excludes common localhost health endpoints (127.0.0.1/localhost) to reduce noise. The rule is triggered on successful pods/exec events (io.k8s.core.v1.pods.exec.create/get) reported in GCP Audit Logs (data stream logs-gcp.audit-*). This helps identify post-exploitation interactive access and potential command-and-control attempts within a Kubernetes/GKE cluster. It maps to MITRE techniques such as Container Administration Command (T1609), Command and Scripting Interpreter (T1059), and Non-Application Layer Protocol (T1095). The rule relies on a GCP Fleet integration with GKE audit logs enabled. When matched, it prompts triage to verify actor identity, scope of the pod, related activities (secret reads, additional pods/exec sessions, RBAC changes), and to determine remediation steps such as session termination, workload isolation, credential rotation, and pod-level access revocation if not strictly authorized.