Detects successful GKE pod exec sessions where the executed command references high-value host or in-cluster paths and credential-related artifacts. The rule monitors gcp.audit labels for gke.io/command during pods/exec and flags commands that touch sensitive locations (e.g., service accounts, kubelet/config areas, host identity stores, root/home credential directories), common private-key/keystore extensions, environment dumps, or filenames indicative of embedded secrets. A narrow exclusion ignores benign resolv.conf reads. Triggered alerts are tied to gcp.audit logs (data_stream: gcp.audit) and the command string reconstruction. The intention is to surface credential-access attempts within a pod/exec context before lateral movement. The rule maps to MITRE ATT&CK techniques T1552 (Unsecured Credentials) with subtechniques T1552.001 (Credentials In Files) and T1552.007 (Container API), plus T1609 (Container Administration Command) under Execution. Operational setup requires the GCP Fleet integration with GKE audit logs enabled. False positives may arise from break-glass debugging or vendor diagnostics that read credential-like paths; require analyst validation and contextual correlation (identity, workload, RBAC changes, related token reads). Remediation guidance includes ending the exec session, isolating the pod/node, rotating potentially exposed credentials, and tightening pods/exec RBAC and admission controls.