tfMITRE ATT&CK technique

Container Administration Command T1609

Tactic: Execution
Platform: Containers
Version: 1.3
Created: 29 March 2021
Last modified: 24 October 2025
Contributors: Alfredo Oliveira, Trend Micro; David Fiser, @anu4is, Trend Micro; Brad Geesaman, @bradgeesaman; Center for Threat-Informed Defense (CTID); Magno Logan, @magnologan, Trend Micro; Vishwas Manral, McAfee; Yossi Weizman, Azure Defender Research Team

Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.[1][2][3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware71st pct

Tools & malware71st percentile · 69% of ATT&CK techniques have fewer tools implementing them.

Detection rules54th pct

Detection rules54th percentile · 49% of ATT&CK techniques have fewer detection rules written.

tfMITRE ATT&CK technique

Container Administration Command T1609

Tactic: Execution
Platform: Containers
Version: 1.3
Created: 29 March 2021
Last modified: 24 October 2025
Contributors: Alfredo Oliveira, Trend Micro; David Fiser, @anu4is, Trend Micro; Brad Geesaman, @bradgeesaman; Center for Threat-Informed Defense (CTID); Magno Logan, @magnologan, Trend Micro; Vishwas Manral, McAfee; Yossi Weizman, Azure Defender Research Team

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware71st pct

Tools & malware71st percentile · 69% of ATT&CK techniques have fewer tools implementing them.

Detection rules54th pct

Detection rules54th percentile · 49% of ATT&CK techniques have fewer detection rules written.

Container Administration Command MITRE reference T1609

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamTNTG0139 ↗

Executed Hildegard through the kubelet API run command and by executing commands on running containers.1

created 2021-10-011 reference

All 1 groups for this technique

7 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has utilized container administration commands to gather details of compromised hosts and gather credentials to include Kubernetes command-line utilities kubectl get secrets.1 2

created 2026-07-29MALWAREcarried by 1 group

CanisterWormS9042 ↗

Can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.1 2

created 2026-07-24MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Can use kubectl get secrets to extract credentials from Kubernetes.1

created 2026-07-01MALWAREcarried by 1 group

PeiratesS0683 ↗

Can use kubectl or the Kubernetes API to run commands.1

created 2022-02-08TOOLcarried by 1 group

SiloscapeS0623 ↗

Can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.1

created 2021-06-18MALWARE

HildegardS0601 ↗

Was executed through the kubelet API run command and by executing commands on running containers.1

created 2021-04-07MALWAREcarried by 1 group

All 7 software entries for this technique · 6 newest in this preview

Data component	Name	Channel
Process CreationDC0032	kubernetes:apiserver	kubectl exec or kubelet API calls targeting running pods
Command ExecutionDC0064	docker:daemon	docker exec or docker run with unexpected command/entrypoint

Data component

Name

Channel

Process CreationDC0032

kubernetes:apiserver

kubectl exec or kubelet API calls targeting running pods

Command ExecutionDC0064

docker:daemon

docker exec or docker run with unexpected command/entrypoint

Field	What you tune
AuthorizedAdminUsers	Expected admin accounts allowed to use exec commands; anomalies outside this list indicate possible abuse.
ExecFrequencyThreshold	Defines how often `docker exec` or `kubectl exec` is normally observed; sudden spikes may indicate adversary behavior.
SourceIPRange	Expected IP ranges for management actions (e.g., cluster control plane). Requests from external/unexpected ranges may indicate compromise.
NamespaceScope	Defines which namespaces typically allow exec operations; anomalous activity outside these may indicate lateral movement.

Field

What you tune

AuthorizedAdminUsers

Expected admin accounts allowed to use exec commands; anomalies outside this list indicate possible abuse.

ExecFrequencyThreshold

Defines how often docker exec or kubectl exec is normally observed; sudden spikes may indicate adversary behavior.

SourceIPRange

Expected IP ranges for management actions (e.g., cluster control plane). Requests from external/unexpected ranges may indicate compromise.

NamespaceScope

Defines which namespaces typically allow exec operations; anomalous activity outside these may indicate lateral movement.

Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Detects potential Kubernetes enumeration or attack activity via the audit log. (...)	Generic	experimental	-	-	Kubernetes Audit · Kubernetes	Execution Container Administration Command Discovery Container and Resource Discovery	-	medium	uniqu3-us3r	2026-04-28	—	597a7e84-187d-458b-9e4f-2f5a0e676711
Detects attempts to execute remote commands, within a Pod's container using e.g. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Execution Container Administration Command	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a1b0ca4e-7835-413e-8471-3ff2b8a66be6
Detects attempts to inject a sidecar container into a running deployment. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Execution Container Administration Command	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	ad9012a6-e518-4432-9890-f3b82b8fc71f

Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
Detects potential Kubernetes enumeration or attack activity via the audit log. (...)	Generic	experimental	-	-	Kubernetes Audit · Kubernetes	Execution Container Administration Command Discovery Container and Resource Discovery	-	medium	uniqu3-us3r	2026-04-28	—	597a7e84-187d-458b-9e4f-2f5a0e676711
Detects attempts to execute remote commands, within a Pod's container using e.g. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Execution Container Administration Command	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a1b0ca4e-7835-413e-8471-3ff2b8a66be6
Detects attempts to inject a sidecar container into a running deployment. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Execution Container Administration Command	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	ad9012a6-e518-4432-9890-f3b82b8fc71f

Container Administration Command T1609

Container Administration Command T1609

Container Administration Command MITRE reference T1609

Container Administration Command MITRE reference T1609

Offense vs defense T1609

Container Administration Command detection strategy DET0065

Detection Strategy for Container Administration Command Abuse

Log sources

Tunable fields

Container Administration Command detections T1609

Container Administration Command detections T1609