GCP_Uunauthorized_GKE_Pod_Token_Endpoint_Usage

Google SecOps@GoogleSecOps

•updated May 1, 2025•0•0•2

Alerts when an authorization token originating from GKE activity is subsequently used within a command line on an endpoint system, suggesting potential credential exfiltration and reuse.