Techniques › T1609 › AN0177
AN0177 Analytic 0177
Containers · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Defenders may detect abuse of container administration commands by observing anomalous use of management utilities (
docker exec, kubectl exec, or API calls to kubelet) correlated with unexpected process creation inside containers. Behavioral chains include unauthorized API requests followed by command execution within running pods or containers, often originating from unusual user accounts, automation scripts, or IP addresses outside the expected cluster management plane.</p>- Detects
- T1609 Container Administration Command
- Part of
- DET0065 Detection Strategy for Container Administration Command Abuse
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| docker:daemon | docker exec or docker run with unexpected command/entrypoint | DC0064 Command Execution |
| kubernetes:apiserver | kubectl exec or kubelet API calls targeting running pods | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuthorizedAdminUsers | Expected admin accounts allowed to use exec commands; anomalies outside this list indicate possible abuse. |
ExecFrequencyThreshold | Defines how often `docker exec` or `kubectl exec` is normally observed; sudden spikes may indicate adversary behavior. |
SourceIPRange | Expected IP ranges for management actions (e.g., cluster control plane). Requests from external/unexpected ranges may indicate compromise. |
NamespaceScope | Defines which namespaces typically allow exec operations; anomalous activity outside these may indicate lateral movement. |