Detects when an ephemeral container is added to or updated in an existing Kubernetes pod on GKE by a non-system identity, using Google Cloud audit logs. The rule targets successful events in the gcp.audit dataset where service.name is "k8s.io" and event.action corresponds to ephemeralcontainers.update or ephemeralcontainers.patch, within a 6-minute ingestion window. It excludes operations performed by system accounts (e.g., system:node:* or system:serviceaccount:kube-system:*). Ephemeral containers are often used for debugging but can be abused to inject tooling, access mounted secrets, or execute commands in the target pod context, potentially enabling privilege escalation, lateral movement, or persistence without deploying a new workload. The rule maps to MITRE ATT&CK techniques T1611 (Escape to Host) under Privilege Escalation and T1609 (Container Administration Command) under Execution. False positives can arise from legitimate debugging by cluster operators; an allowlist of known admin identities should be applied after review. Triage guidance includes verifying the identity (client.user.email, source.ip, user_agent.original), identifying the targeted pod via gcp.audit.resource_name, and inspecting the ephemeral container image, command, and securityContext. Correlate with follow-on activity such as pod exec, secret reads, TokenRequest, or RBAC changes. Remediation steps include revoking excessive RBAC permissions that allow updates/patches to pods/ephemeralcontainers, rotating exposed credentials, quarantining or redeploying affected workloads, and hunting for additional compromised pods or identities. Setup requires the GCP Fleet integration with GKE audit logs enabled. References include Kubernetes ephemeral containers documentation.