Cross-source coverage
T1613 / ATT&CK
Container and Resource Discovery
52 rules across 4 sources.
From MITRE ATT&CK 19.2
Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.
These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs. In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
- Tactics
- Discovery
- Platforms
- Containers
- Telemetry
-
kubernetes:apiserverdocker:daemon
How MITRE says to detect it DET0490
Detection Strategy for Container and Resource Discovery
Containers Analytic 1352
Detection of adversary attempts to enumerate containers, pods, nodes, and related resources within containerized environments. Defenders may observe anomalous API calls to Docker or Kubernetes (e.g., 'docker ps', 'kubectl get pods', 'kubectl get nodes'), unusual account activity against the Kubernetes dashboard, or unexpected queries against container metadata endpoints. These events should be correlated with user context and network activity to reveal resource discovery attempts.
kubernetes:apiserverlist or get requests against pods, deployments, or nodesdocker:daemondocker ps, docker inspect, or docker images commands
elastic/detection-rules
47 rules| Detection | Severity | Format |
|---|---|---|
| GKE Secrets List from Unusual Source AS Organization | High | Elastic TOML |
| Kubectl Secrets Enumeration Across All Namespaces | High | Elastic TOML |
| Kubernetes Secrets List Across Cluster or Sensitive Namespaces | High | Elastic TOML |
| Potential Direct Kubelet Access via Process Arguments | High | Elastic TOML |
| Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers | High | Elastic TOML |
| Potential Kubeletctl Execution Detected via Defend for Containers | High | Elastic TOML |
| Azure AKS Potential API Enumeration by User | Medium | Elastic TOML |
| Direct Interactive Kubernetes API Request by Common Utilities | Medium | Elastic TOML |
| Docker Socket Enumeration | Medium | Elastic TOML |
| Forbidden Direct Interactive Kubernetes API Request | Medium | Elastic TOML |
+ 37 more from elastic/detection-rules → showing the 10 highest-severity
panther-labs/panther-analysis
3 rules| Detection | Severity | Format |
|---|---|---|
| Kubernetes Secret Access Denied | Medium | Panther Python |
| EKS Audit Log based single sourceIP is generating multiple 403s | Informational | Panther Python |
| Kubernetes API Multiple 403 Responses from Single Public IP | Informational | Panther Python |
SigmaHQ/sigma
1 rule| Detection | Severity | Format |
|---|---|---|
| Kubernetes Potential Enumeration Activity | Medium | Sigma |
elastic/protections-artifacts
1 rule| Detection | Severity | Format |
|---|---|---|
| Script DNS Query to Managed Kubernetes Cluster | Undefined | Elastic TOML |