Techniques › T1609
T1609 Container Administration Command
execution — Containers · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
3
Sigma rules tagged attack.t1609
0
KEV CVEs mapped here
<p>Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.</p><p>In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <code>docker exec</code> to execute a command within a running container. In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as <code>kubectl exec</code>.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0065 Detection Strategy for Container Administration Command Abuse v1.0
AN0177 ContainersDefenders may detect abuse of container administration commands by observing anomalous use of management utilities (
docker exec,kubectl exec, or API calls to kubelet) correlated with unexpected process creation inside containers. Behavioral chains include unauthorized API requests followed by command execution within running pods or containers, often originating from unusual user accounts, automation scripts, or IP addresses outside the expected cluster management plane.docker:daemondocker exec or docker run with unexpected command/entrypoint→ DC0064 Command Executionkubernetes:apiserverkubectl exec or kubelet API calls targeting running pods→ DC0032 Process CreationTunable:AuthorizedAdminUsersExecFrequencyThresholdSourceIPRangeNamespaceScope
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1609
Author: uniqu3-us3r
· 2026-04-28 · logsource: product=kubernetes service=audit · 597a7e84-187d-458b-9e4f-2f5a0e676711
Detects potential Kubernetes enumeration or attack activity via the audit log.
This includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.
Attackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · a1b0ca4e-7835-413e-8471-3ff2b8a66be6
Detects attempts to execute remote commands, within a Pod's container using e.g. the "kubectl exec" command.
Author: Leo Tsaousis (@laripping)
· 2024-03-26 · logsource: product=kubernetes category=application service=audit · ad9012a6-e518-4432-9890-f3b82b8fc71f
Detects attempts to inject a sidecar container into a running deployment.
A sidecar container is an additional container within a pod, that resides alongside the main container.
One way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a "kubectl patch" operation.
By injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.