1. Home
  2. ATT&CK Techniques
  3. T1609 Container Administration Command

T1609 Container Administration Command

Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)

In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <code>docker exec</code> to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as <code>kubectl exec</code>.(Citation: Kubectl Exec Get Shell)

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
PR.AA-05.02 Privileged system access Mitigates T1609 Container Administration Command
Comments
This diagnostic statement protects against Container Administration Command through the use of privileged account management and the use of multi-factor authentication.
References
    DE.CM-06.02 Third-party access monitoring Mitigates T1609 Container Administration Command
    Comments
    This diagnostic statement protects against Container Administration Command through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems.
    References
      PR.AA-05.01 Access privilege limitation Mitigates T1609 Container Administration Command
      Comments
      This diagnostic statement describes the implementation of least privilege principle, which can be applied to limiting permissions through role-based access controls, file and directory permissions, and the execution of systems and services. An adversary must already have high-level, admin or root level access on a local system to make full use of these ATT&CK techniques. Restrict users and accounts to the least privileges they require can help mitigate these techniques.
      References
        PR.AA-01.02 Physical and logical access Mitigates T1609 Container Administration Command
        Comments
        This diagnostic statement describes how the organization ensures users are identified and authenticated before accessing systems, applications, and hardware, with logical access controls permitting access only to authorized individuals with legitimate business needs. Logical access controls in relation to systems can refer to the use of MFA, user account management, and other role-based access control mechanisms to enforce policies for authentication and authorization of user accounts.
        References
          PR.AA-03.01 Authentication requirements Mitigates T1609 Container Administration Command
          Comments
          This diagnostic statement describes how the organization implement appropriate authentication requirements, including selecting mechanisms based on risk, utilizing multi-factor authentication where necessary, and safeguarding the storage of authenticators like pins and passwords to protect sensitive access credentials.
          References
            PR.IR-01.02 Network device configurations Mitigates T1609 Container Administration Command
            Comments
            This diagnostic statement provides protection through secure network device configurations (e.g., firewall rules, ports, and protocols) aligned to security baselines. Using network appliances to limit communications with container services can prevent adversary abuse of container administration.
            References
              PR.IR-01.03 Network communications integrity and availability Mitigates T1609 Container Administration Command
              Comments
              This diagnostic statement protects against Container Administration Command through the use of secure network configurations, architecture, implementations of zero trust architecture, and segmentation.
              References
                PR.IR-01.05 Remote access protection Mitigates T1609 Container Administration Command
                Comments
                This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access.
                References
                  PR.IR-01.06 Production environment segregation Mitigates T1609 Container Administration Command
                  Comments
                  This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise.
                  References
                    PR.AA-01.01 Identity and credential management Mitigates T1609 Container Administration Command
                    Comments
                    This diagnostic statement protects against Container Administration Command through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts.
                    References
                      PR.PS-01.08 End-user device protection Mitigates T1609 Container Administration Command
                      Comments
                      This diagnostic statement protects against Container Administration Command through the use of limiting access to resources to only authorized devices, management of personal computing devices, network intrusion prevention, and the use of antimalware.
                      References

                        NIST 800-53 Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        CM-06 Configuration Settings mitigates T1609 Container Administration Command
                        AC-17 Remote Access mitigates T1609 Container Administration Command
                        SI-10 Information Input Validation mitigates T1609 Container Administration Command
                        SI-07 Software, Firmware, and Information Integrity mitigates T1609 Container Administration Command
                        CM-07 Least Functionality mitigates T1609 Container Administration Command
                        AC-02 Account Management mitigates T1609 Container Administration Command
                        AC-03 Access Enforcement mitigates T1609 Container Administration Command
                        AC-04 Information Flow Enforcement mitigates T1609 Container Administration Command
                        AC-05 Separation of Duties mitigates T1609 Container Administration Command
                        AC-06 Least Privilege mitigates T1609 Container Administration Command
                        SC-07 Boundary Protection mitigates T1609 Container Administration Command

                        VERIS Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        action.hacking.variety.Abuse of functionality Abuse of functionality. related-to T1609 Container Administration Command

                        Azure Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        defender_for_containers Microsoft Defender for Containers technique_scores T1609 Container Administration Command
                        Comments
                        This capability can detect abuse of container administration services.
                        References
                        1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction
                        defender_for_containers Microsoft Defender for Containers technique_scores T1609 Container Administration Command
                        Comments
                        This capability can protect against abuse of container administration services.
                        References
                        1. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction

                        GCP Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        gke_enterprise GKE Enterprise technique_scores T1609 Container Administration Command
                        Comments
                        GKE Enterprise incorporates the Anthos Config Management feature to create and manage Kubernetes objects across multiple clusters at once. PodSecurityPolicies can be enforced to prevent Pods from using the root Linux user and prevents pods from running privileged containers. In hindsight this can ensure containers are not running as root by default.
                        References
                        1. ['https://cloud.google.com/kubernetes-engine/enterprise/docs']
                        google_kubernetes_engine Google Kubernetes Engine technique_scores T1609 Container Administration Command
                        Comments
                        This control may provide provide information about vulnerabilities within container images, such as the risk from remote management of a deployed container. With the right permissions, an adversary could escalate to remote code execution in the Kubernetes cluster.
                        References
                        1. ['https://cloud.google.com/kubernetes-engine/docs/concepts/access-control'
                        2. 'https://cloud.google.com/kubernetes-engine/docs/concepts/cis-benchmarks#how_to_audit_benchmarks']

                        AWS Mappings

                        Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
                        aws_config AWS Config technique_scores T1609 Container Administration Command
                        Comments
                        The "eks-endpoint-no-public-access" managed rule can identify whether Amazon Elastic Kubernetes Service (Amazon EKS) endpoints are misconfigured to allow public endpoint access, which should be fixed in order to prevent malicious external access to the Kubernetes API server, including malicious attempts to execute commands via the API. It is run periodically and only provides partial coverage because it is specific to public access, resulting in an overall score of Partial.
                        References
                        1. https://docs.aws.amazon.com/config
                        2. https://docs.aws.amazon.com/config/latest/developerguide
                        3. https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html