Container and Resource Discovery T1613
Tactic: Discovery
Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.
Events covered
1 catalog event is tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| ESF | exec | Process Execution |
Authoring guide
These 53 rules share fields, values, and exclusions.
Fields filtered most (70 distinct)
These fields appear most often in rule filters.
Top indicator values (734 distinct)
These values appear most often in rule predicates.
Exclusions (215 distinct)
These values appear most often in top-level exclusions.
Rules under this technique
These vendors publish rules tagged with this technique.
Sigma 1 rule
Elastic 49 rules
- Azure AKS Potential API Enumeration by User
- Azure AKS Suspicious Self-Subject Review by Service Account or Node Identity
- Container Management Utility Execution Detected via Defend for Containers
- Container Management Utility Run Inside A Container
- Direct Interactive Kubernetes API Request by Common Utilities
- Direct Interactive Kubernetes API Request by Unusual Utilities
- Direct Kubernetes API Request Detected via Defend for Containers
- DNS Enumeration Detected via Defend for Containers
- Docker Socket Enumeration
- Environment Variable Enumeration Detected via Defend for Containers
- Forbidden Direct Interactive Kubernetes API Request
- GitHub Authentication Token Access via Node.js
- GKE Anonymous Endpoint Permission Enumeration
- GKE API Request Failure Burst by User
- GKE API Server Proxying Request to Kubelet
- GKE Endpoint Permission Enumeration
- GKE Forbidden Request from Unusual User Agent
- GKE Multi-Resource Discovery
- GKE Secrets List from Unusual Source AS Organization
- GKE Suspicious Self-Subject Review via Service Account
- Kubeconfig File Discovery
- Kubectl Configuration Discovery
- Kubectl Permission Discovery
- Kubectl Secrets Enumeration Across All Namespaces
- Kubectl Workload and Cluster Discovery
- Kubelet API Connection Attempt to Internal IP
- Kubelet Certificate File Access Detected via Defend for Containers
- Kubelet Pod Discovery Detected via Defend for Containers
- Kubernetes API Server Proxying Request to Kubelet
- Kubernetes Direct API Request via Curl or Wget
- Kubernetes Forbidden Request from Unusual User Agent
- Kubernetes Multi-Resource Discovery
- Kubernetes Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected
- Kubernetes Potential Endpoint Permission Enumeration Attempt Detected
- Kubernetes Secrets List Across Cluster or Sensitive Namespaces
- Kubernetes Service Account Secret Access
- Kubernetes Suspicious Self-Subject Review via Unusual User Agent
- Potential Cluster Enumeration via jq Detected via Defend for Containers
- Potential Direct Kubelet Access via Process Arguments
- Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers
- Potential Kubectl Masquerading via Unexpected Process
- Potential Kubeletctl Execution
- Potential Kubeletctl Execution Detected via Defend for Containers
- Privilege Boundary Enumeration Detected via Defend for Containers
- Script DNS Query to Managed Kubernetes Cluster
- Service Account Namespace Read Detected via Defend for Containers
- Service Account Token or Certificate Access Followed by Kubernetes API Request
- Tool Enumeration Detected via Defend for Containers
- Unusual Process Connection to Docker or Containerd Socket