Cross-source coverage
T1609 / ATT&CK
Container Administration Command
35 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.
In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container. In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.
- Tactics
- Execution
- Platforms
- Containers
- Telemetry
-
docker:daemonkubernetes:apiserver
How MITRE says to detect it DET0065
Detection Strategy for Container Administration Command Abuse
Containers Analytic 0177
Defenders may detect abuse of container administration commands by observing anomalous use of management utilities (`docker exec`, `kubectl exec`, or API calls to kubelet) correlated with unexpected process creation inside containers. Behavioral chains include unauthorized API requests followed by command execution within running pods or containers, often originating from unusual user accounts, automation scripts, or IP addresses outside the expected cluster management plane.
docker:daemondocker exec or docker run with unexpected command/entrypointkubernetes:apiserverkubectl exec or kubelet API calls targeting running pods
elastic/detection-rules
32 rules| Detection | Severity | Format |
|---|---|---|
| Azure AKS Kubelet Proxy to Command Execution Endpoint | High | Elastic TOML |
| GKE Pod Exec Cloud Instance Metadata Access | High | Elastic TOML |
| GKE Pod Exec Potential Reverse Shell | High | Elastic TOML |
| GKE Pod Exec Sensitive File or Credential Path Access | High | Elastic TOML |
| GKE Pod Exec with Curl or Wget to HTTPS | High | Elastic TOML |
| Kubernetes Pod Exec Cloud Instance Metadata Access | High | Elastic TOML |
| Kubernetes Pod Exec Potential Reverse Shell | High | Elastic TOML |
| Kubernetes Pod Exec Sensitive File or Credential Path Access | High | Elastic TOML |
| Kubernetes Pod Exec with Curl or Wget to HTTPS | High | Elastic TOML |
| Potential Kubeletctl Execution Detected via Defend for Containers | High | Elastic TOML |
+ 22 more from elastic/detection-rules → showing the 10 highest-severity
SigmaHQ/sigma
3 rules| Detection | Severity | Format |
|---|---|---|
| Kubernetes Potential Enumeration Activity | Medium | Sigma |
| Potential Remote Command Execution In Pod Container | Medium | Sigma |
| Potential Sidecar Injection Into Running Deployment | Medium | Sigma |