Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment.
Containers can be deployed by various means, such as via Docker's <code>create</code> and <code>start</code> APIs or via a web application such as the Kubernetes dashboard or Kubeflow.(Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)
View in MITRE ATT&CK®Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name |
---|---|---|---|---|
AC-17 | Remote Access | Protects | T1610 | Deploy Container |
AC-2 | Account Management | Protects | T1610 | Deploy Container |
AC-3 | Access Enforcement | Protects | T1610 | Deploy Container |
AC-6 | Least Privilege | Protects | T1610 | Deploy Container |
CM-6 | Configuration Settings | Protects | T1610 | Deploy Container |
CM-7 | Least Functionality | Protects | T1610 | Deploy Container |
IA-2 | Identification and Authentication (organizational Users) | Protects | T1610 | Deploy Container |
SC-7 | Boundary Protection | Protects | T1610 | Deploy Container |
SI-4 | System Monitoring | Protects | T1610 | Deploy Container |
action.malware.variety.Unknown | Unknown | related-to | T1610 | Deploy Container |
aws_config | AWS Config | technique_scores | T1610 | Deploy Container |
aws_cloudwatch | AWS CloudWatch | technique_scores | T1610 | Deploy Container |