{"id":"T1609","name":"Container Administration Command","url":"https://attack.mitre.org/techniques/T1609","tactics":["execution"],"platforms":["Containers"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0065","stix_id":"x-mitre-detection-strategy--e9a74ecb-cc65-4c21-ae40-850e3317c248","name":"Detection Strategy for Container Administration Command Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0065","analytics":[{"id":"AN0177","stix_id":"x-mitre-analytic--ab1122c5-f459-4097-8ba7-f5a7960d2da5","name":"Analytic 0177","description":"Defenders may detect abuse of container administration commands by observing anomalous use of management utilities (`docker exec`, `kubectl exec`, or API calls to kubelet) correlated with unexpected process creation inside containers. Behavioral chains include unauthorized API requests followed by command execution within running pods or containers, often originating from unusual user accounts, automation scripts, or IP addresses outside the expected cluster management plane.","url":"https://attack.mitre.org/detectionstrategies/DET0065#AN0177","platforms":["Containers"],"log_source_references":[{"name":"docker:daemon","channel":"docker exec or docker run with unexpected command/entrypoint","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"docker-daemon"},{"name":"kubernetes:apiserver","channel":"kubectl exec or kubelet API calls targeting running pods","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"kubernetes-apiserver"}],"mutable_elements":[{"field":"AuthorizedAdminUsers","description":"Expected admin accounts allowed to use exec commands; anomalies outside this list indicate possible abuse."},{"field":"ExecFrequencyThreshold","description":"Defines how often `docker exec` or `kubectl exec` is normally observed; sudden spikes may indicate adversary behavior."},{"field":"SourceIPRange","description":"Expected IP ranges for management actions (e.g., cluster control plane). Requests from external/unexpected ranges may indicate compromise."},{"field":"NamespaceScope","description":"Defines which namespaces typically allow exec operations; anomalous activity outside these may indicate lateral movement."}],"live":true,"detection_strategies":["DET0065"],"techniques":["T1609"]}],"live":true,"version":"1.0","techniques":["T1609"]}],"sigma_rules":[{"id":"597a7e84-187d-458b-9e4f-2f5a0e676711","title":"Kubernetes Potential Enumeration Activity","author":"uniqu3-us3r","status":"experimental","level":"medium","date":"2026-04-28","modified":null,"description":"Detects potential Kubernetes enumeration or attack activity via the audit log.\nThis includes the execution of common shells, utilities, or specialized tools like 'Rakkess' (access_matrix) and 'TruffleHog' via Kubernetes API requests.\nAttackers use these methods to perform reconnaissance (enumeration), secret harvesting, or execute code (exec) within a cluster.\n","references":["https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/","https://github.com/trufflesecurity/trufflehog","https://github.com/corneliusweig/rakkess"],"logsource":{"product":"kubernetes","service":"audit"},"tags":["attack.execution","attack.discovery","attack.t1609","attack.t1613"],"path":"rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml","techniques":["T1609","T1613"],"cves":[]},{"id":"a1b0ca4e-7835-413e-8471-3ff2b8a66be6","title":"Potential Remote Command Execution In Pod Container","author":"Leo Tsaousis (@laripping)","status":"test","level":"medium","date":"2024-03-26","modified":null,"description":"Detects attempts to execute remote commands, within a Pod's container using e.g. the \"kubectl exec\" command.\n","references":["https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/"],"logsource":{"product":"kubernetes","category":"application","service":"audit"},"tags":["attack.t1609","attack.execution"],"path":"rules/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml","techniques":["T1609"],"cves":[]},{"id":"ad9012a6-e518-4432-9890-f3b82b8fc71f","title":"Potential Sidecar Injection Into Running Deployment","author":"Leo Tsaousis (@laripping)","status":"test","level":"medium","date":"2024-03-26","modified":null,"description":"Detects attempts to inject a sidecar container into a running deployment.\nA sidecar container is an additional container within a pod, that resides alongside the main container.\nOne way to add containers to running resources like Deployments/DeamonSets/StatefulSets, is via a \"kubectl patch\" operation.\nBy injecting a new container within a legitimate pod, an attacker can run their code and hide their activity, instead of running their own separated pod in the cluster.\n","references":["https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch","https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/"],"logsource":{"product":"kubernetes","category":"application","service":"audit"},"tags":["attack.t1609","attack.execution"],"path":"rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml","techniques":["T1609"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}