T1609 Container Administration Command
Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet) In Docker, adversaries may specify an…
Quién la usa · con noticias en Jábega
Reglas Sigma para cazarla
- Potential Remote Command Execution In Pod Containermediumtest · kubernetes
- Potential Sidecar Injection Into Running Deploymentmediumtest · kubernetes
- Kubernetes Potential Enumeration Activitymediumexperimental · kubernetes
Reglas de SigmaHQ · Detection Rule License 1.1. Técnica de MITRE ATT&CK®.