Container Administration Command T1609
Tactic: Execution
Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.
Events covered
1 catalog event is tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| ESF | exec | Process Execution |
Authoring guide
These 36 rules share fields, values, and exclusions.
Fields filtered most (39 distinct)
These fields appear most often in rule filters.
Top indicator values (448 distinct)
These values appear most often in rule predicates.
Exclusions (127 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 3 rules
- Kubernetes Potential Enumeration Activity
- Potential Remote Command Execution In Pod Container
- Potential Sidecar Injection Into Running Deployment
Elastic 33 rules
- Azure AKS API Server Proxying Request to Kubelet
- Azure AKS Attempted User Exec into Pod
- Azure AKS Kubelet Proxy to Command Execution Endpoint
- Container Management Utility Execution Detected via Defend for Containers
- Container Management Utility Run Inside A Container
- Container Runtime CLI Execution with Suspicious Arguments
- Direct Interactive Kubernetes API Request by Common Utilities
- Direct Interactive Kubernetes API Request by Unusual Utilities
- Direct Kubernetes API Request Detected via Defend for Containers
- Docker Socket Enumeration
- Exec Into Container Detected via Defend for Containers
- Forbidden Direct Interactive Kubernetes API Request
- GKE Ephemeral Container Added to Pod
- GKE Pod Exec Cloud Instance Metadata Access
- GKE Pod Exec Potential Reverse Shell
- GKE Pod Exec Sensitive File or Credential Path Access
- GKE Pod Exec with Curl or Wget to HTTPS
- GKE User Exec into Pod
- Kubectl Apply Pod from URL
- Kubernetes Ephemeral Container Added to Pod
- Kubernetes Pod Creation Using Common Debug or Base Images
- Kubernetes Pod Exec Cloud Instance Metadata Access
- Kubernetes Pod Exec Potential Reverse Shell
- Kubernetes Pod Exec Sensitive File or Credential Path Access
- Kubernetes Pod Exec with Curl or Wget to HTTPS
- Kubernetes User Exec into Pod
- Pod or Container Creation with Suspicious Command-Line
- Potential Kubectl Masquerading via Unexpected Process
- Potential Kubeletctl Execution
- Potential Kubeletctl Execution Detected via Defend for Containers
- Privileged Container Creation with Host Directory Mount
- Privileged Docker Container Creation
- Suspicious Container Runtime CLI Execution