Home
ATT&CK Techniques
T1098.006 Additional Container Cluster Roles

T1098.006 Additional Container Cluster Roles

An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system. For example, an adversary with sufficient permissions may create a RoleBinding or a ClusterRoleBinding to bind a Role or ClusterRole to a Kubernetes account.(Citation: Kubernetes RBAC)(Citation: Aquasec Kubernetes Attack 2023) Where attribute-based access control (ABAC) is in use, an adversary with sufficient permissions may modify a Kubernetes ABAC policy to give the target account additional permissions.(Citation: Kuberentes ABAC)

This account modification may immediately follow Create Account or other malicious account activity. Adversaries may also modify existing Valid Accounts that they have compromised.

Note that where container orchestration systems are deployed in cloud environments, as with Google Kubernetes Engine, Amazon Elastic Kubernetes Service, and Azure Kubernetes Service, cloud-based role-based access control (RBAC) assignments or ABAC policies can often be used in place of or in addition to local permission assignments.(Citation: Google Cloud Kubernetes IAM)(Citation: AWS EKS IAM Roles for Service Accounts)(Citation: Microsoft Azure Kubernetes Service Service Accounts) In these cases, this technique may be used in conjunction with Additional Cloud Roles.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
PR.IR-01.05	Remote access protection	Mitigates	T1098.006	Additional Container Cluster Roles	Comments This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access. References
DE.CM-03.03	Privileged account monitoring	Mitigates	T1098.006	Additional Container Cluster Roles	Comments This diagnostic statement implements mechanisms and tools to mitigate potential misuse of privileged users and accounts. Continuous monitoring of role and attribute assignments and activity is essential to prevent and detect unauthorized access or misuse. References
PR.AA-05.02	Privileged system access	Mitigates	T1098.006	Additional Container Cluster Roles	Comments This diagnostic statement protects against Additional Container Cluster Roles through the use of privileged account management and the use of multi-factor authentication. References
PR.AA-02.01	Authentication of identity	Mitigates	T1098.006	Additional Container Cluster Roles	Comments This diagnostic statement provides protection from Account Manipulation through the implementation of privileged account management controls to limit credential access. Employing limitations to specific accounts, access control mechanisms, and auditing the attribution logs provides protection against adversaries attempting to modify accounts. References
PR.PS-01.07	Cryptographic keys and certificates	Mitigates	T1098.006	Additional Container Cluster Roles	Comments This diagnostic statement protects against Account Manipulation through the use of revocation of keys and key management. Employing limitations to specific accounts along with access control mechanisms provides protection against adversaries attempting to manipulate accounts. References
PR.AA-01.02	Physical and logical access	Mitigates	T1098.006	Additional Container Cluster Roles	Comments This diagnostic statement describes how the organization ensures users are identified and authenticated before accessing systems, applications, and hardware, with logical access controls permitting access only to authorized individuals with legitimate business needs. Logical access controls in relation to systems can refer to the use of MFA, user account management, and other role-based access control mechanisms to enforce policies for authentication and authorization of user accounts. References
PR.AA-03.01	Authentication requirements	Mitigates	T1098.006	Additional Container Cluster Roles	Comments This diagnostic statement describes how the organization implement appropriate authentication requirements, including selecting mechanisms based on risk, utilizing multi-factor authentication where necessary, and safeguarding the storage of authenticators like pins and passwords to protect sensitive access credentials. References
PR.AA-01.01	Identity and credential management	Mitigates	T1098.006	Additional Container Cluster Roles	Comments This diagnostic statement protects against Additional Container Cluster Roles through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts. References

NIST 800-53 Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name
IA-05	Authenticator Management	mitigates	T1098.006	Additional Container Cluster Roles
AC-03	Access Enforcement	mitigates	T1098.006	Additional Container Cluster Roles
AC-02	Account Management	mitigates	T1098.006	Additional Container Cluster Roles
AC-06	Least Privilege	mitigates	T1098.006	Additional Container Cluster Roles

VERIS Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
action.hacking.variety.Backdoor	Hacking action that creates a backdoor for use.	related-to	T1098.006	Additional Container Cluster Roles
attribute.integrity.variety.Modify privileges	Modified privileges or permissions	related-to	T1098.006	Additional Container Cluster Roles

Azure Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
azure_role_based_access_control	Azure Role-Based Access Control	technique_scores	T1098.006	Additional Container Cluster Roles	Comments This control can be used to implement the least-privilege principle for account management and thereby limit the number of accounts that can modify accounts. References https://learn.microsoft.com/en-us/azure/role-based-access-control/overview
defender_for_containers	Microsoft Defender for Containers	technique_scores	T1098.006	Additional Container Cluster Roles	Comments This control can detect when changes are made to containers that indicate account manipulation. References https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction

GCP Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
security_command_center	Security Command Center	technique_scores	T1098.006	Additional Container Cluster Roles	Comments SCC ingests Cloud Audit logs to detect when permissions are changed in a privileged group (i.e., modify group to public) with sensitive permissions or roles. This security solution protects against compromised cloud accounts used to maintain persistence. Because of the near-real time temporal factor to detect against this cyber-attack the control was graded as significant. References ['https://cloud.google.com/security-command-center/docs/concepts-security-command-center-overview' 'https://cloud.google.com/security-command-center/docs/reference/rest/v2/organizations.sources.findings']