tfMITRE ATT&CK technique

Container Administration Command T1609

Tactic: Execution
Platform: Containers
Version: 1.3
Created: 29 March 2021
Last modified: 24 October 2025
Contributors: Alfredo Oliveira, Trend Micro; David Fiser, @anu4is, Trend Micro; Brad Geesaman, @bradgeesaman; Center for Threat-Informed Defense (CTID); Magno Logan, @magnologan, Trend Micro; Vishwas Manral, McAfee; Yossi Weizman, Azure Defender Research Team

Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.[1][2][3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware71st pct

Tools & malware71st percentile · 71% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules54th pct

Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer.

Container Administration Command MITRE reference T1609

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamTNTG0139 ↗

Executed Hildegard through the kubelet API run command and by executing commands on running containers.1

created 2021-10-011 reference

All 1 groups for this technique

7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has utilized container administration commands to gather details of compromised hosts and gather credentials to include Kubernetes command-line utilities kubectl get secrets.1 2

created 2026-07-29MALWAREcarried by 1 group

CanisterWormS9042 ↗

Can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.1 2

created 2026-07-24MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Can use kubectl get secrets to extract credentials from Kubernetes.1

created 2026-07-01MALWAREcarried by 1 group

PeiratesS0683 ↗

Can use kubectl or the Kubernetes API to run commands.1

created 2022-02-08TOOLcarried by 1 group

SiloscapeS0623 ↗

Can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.1

created 2021-06-18MALWARE

HildegardS0601 ↗

Was executed through the kubelet API run command and by executing commands on running containers.1

created 2021-04-07MALWAREcarried by 1 group

All 7 software entries for this technique · 6 newest in this preview

Offense vs defense T1609

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 3Splunk ESCU (cumulative) · 0

first rule: 2024 Q1

Container Administration Command detection strategy DET0065

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Container Administration Command Abuse

Enterprise

1 platform

AN0177 · Containers

Defenders may detect abuse of container administration commands by observing anomalous use of management utilities (docker exec, kubectl exec, or API calls to kubelet) correlated with unexpected process creation inside containers. Behavioral chains include unauthorized API requests followed by command execution within running pods or containers, often originating from unusual user accounts, automation scripts, or IP addresses outside the expected cluster management plane.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	kubernetes:apiserver	kubectl exec or kubelet API calls targeting running pods
Command ExecutionDC0064	docker:daemon	docker exec or docker run with unexpected command/entrypoint

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AuthorizedAdminUsers	Expected admin accounts allowed to use exec commands; anomalies outside this list indicate possible abuse.
ExecFrequencyThreshold	Defines how often `docker exec` or `kubectl exec` is normally observed; sudden spikes may indicate adversary behavior.
SourceIPRange	Expected IP ranges for management actions (e.g., cluster control plane). Requests from external/unexpected ranges may indicate compromise.
NamespaceScope	Defines which namespaces typically allow exec operations; anomalous activity outside these may indicate lateral movement.

Disable or Remove Feature or ProgramM1042

Remove unnecessary tools and software from containers.

Execution PreventionM1038

Use read-only containers, read-only file systems, and minimal images when possible to prevent the execution of commands. Where possible, also consider using application control and software restriction tools (such as those provided by SELinux) to restrict access to files, processes, and system calls in containers.

Limit Access to Resource Over NetworkM1035

Limit communications with the container service to managed and secured channels, such as local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API and Kubernetes API Server. In Kubernetes clusters deployed in cloud environments, use native cloud platform features to restrict the IP ranges that are permitted to access to API server. Where possible, consider enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access.

Privileged Account ManagementM1026

Ensure containers are not running as root by default. In Kubernetes environments, consider defining Pod Security Standards that prevent pods from running privileged containers and using the NodeRestriction admission controller to deny the kublet access to nodes and pods outside of the node it belongs to.

User Account ManagementM1018

Enforce authentication and role-based access control on the container service to restrict users to the least privileges required. When using Kubernetes, avoid giving users wildcard permissions or adding users to the system:masters group, and use RoleBindings rather than ClusterRoleBindings to limit user privileges to specific namespaces.

Tests2Executorsbash 2Need elevation0 of 2Have prerequisites2Have cleanup2Platformscontainers

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

ExecIntoContainer

containers

bash

—

Yes

Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“kubectl exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “kubectl exec”.

Input arguments

Name	Type	Default	Description
path	string	$PathtoAtomicsFolder/T1609/src/busybox.yaml	Path to busybox.yaml file
command	string	uname	Command to run
namespace	string	default	K8s namespace to use

Attack command

kubectl create -f #{path} -n #{namespace}
# wait 3 seconds for the instance to come up
sleep 3
kubectl exec -n #{namespace} busybox -- #{command}

Cleanup command

kubectl delete pod busybox -n #{namespace}

Prerequisite

kubectl must be installed

Check

which kubectl

Satisfy

echo "kubectl must be installed manually"

GUID5b74bc6d-5204-4158-9835-1c51e0f0a02f

Docker Exec Into Container

containers

bash

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Container Administration Command detections T1609

3 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

54th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs