TeamPCPG1056 ↗
Has queried the Kubernetes API for local service account tokens and has used kubectl for lateral movement.12
tfMITRE ATT&CK sub-technique
Container CLI/API T1059.013
sub-technique of T1059 Command and Scripting Interpreter
- Tactic
- Execution
- Platform
- Containers
- Version
- 1.0
- Created
- 15 June 2025
- Last modified
- 21 October 2025
- Contributor
- Liran Ravich, CardinalOps
Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
2
Threat groups56th pct
Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.1
Detection rules42nd pct
Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.Container CLI/API MITRE reference T1059.013
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
TeamTNTG0139 ↗
Targeted misconfigured containers and used container CLI tools.1
All 2 groups for this technique
1 software entry is documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Mini Shai-HuludS9043 ↗
Has utilized the Docker command-line tool to gather details of the victim environment and collect credentials.1
All 1 software entries for this technique
Offense vs defense T1059.013
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 1
first rule: 2026 Q1Container CLI/API detection strategy DET0083
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Container CLI and API Abuse via Docker/Kubernetes (T1059.013)
1 platform
AN0233 · Containers
Execution of container orchestration commands (e.g., docker exec, kubectl exec) or API-driven interactions with running containers from unauthorized hosts or non-standard user contexts. Defender sees programmatic or interactive command execution within containers outside expected CI/CD tools or automation frameworks, often followed by file writes, privilege escalation, or lateral discovery.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Pod CreationDC0019 | AWS:CloudTrail | CreatePod: Programmatic creation of new pod resources using container images not seen before in the environment |
| Process CreationDC0032 | auditd:SYSCALL | execve: Execution of container management CLIs (docker, crictl, kubectl) or interpreted shells (sh, bash, python) within container context |
| Command ExecutionDC0064 | kubernetes:audit | Shell process (e.g., /bin/sh, /bin/bash) spawned in a container without an interactive session attached (i.e., automation anomaly) |
| Container CreationDC0072 | kubernetes:apiserver | create/exec: Kubernetes API calls to exec into containers or create pods from curl, kubectl, or SDK clients |
| Container StartDC0077 | docker:events | exec_create: docker exec events targeting running containers from non-CI sources |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AuthorizedUserAgents | List of CI/CD pipeline runners, SRE tools, or cluster mgmt agents allowed to invoke API/CLI commands in containers. |
| NewImageThreshold | Threshold for alerting on unseen container images pulled and executed. Adjust to reduce noise from frequent deploys. |
| TimeWindow | Temporal window to correlate container exec with shell spawn and network activity (default: 2 minutes). |
| InteractiveSessionExpectation | Set whether shell spawns without TTY or PTY should be flagged — based on org deployment model. |
Execution PreventionM1038
Deny scripting where appropriate. Tools such as Python or Go can utilize Kubernetes and Docker within a client library and execute commands within their application.
Restrict permissions on API access. RBAC in Kubernetes involve permissions that are additive, meaning there are no explicit "deny" rules. These permissions can be defined within a particular namespace or within cluster-scoped resources. Securing the Docker daemon can be done by using SSH or TLS with certificate authorization. Container management tools such as Docker and Podman may offer ways to run containers as rootless, which prevents them from running with privileged permissions.