tfMITRE ATT&CK technique

Container and Resource Discovery T1613

Tactic: Discovery
Platform: Containers
Version: 1.1
Created: 31 March 2021
Last modified: 24 October 2025
Contributors: Vishwas Manral, McAfee; Center for Threat-Informed Defense (CTID); Yossi Weizman, Azure Defender Research Team

Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules42nd pct

Detection rules42nd percentile · 58% of ATT&CK techniques have more detection rules written.

Container and Resource Discovery MITRE reference T1613

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamTNTG0139 ↗

Has checked for running containers with docker ps and for specific container names with docker inspect.1 TeamTNT has also searched for Kubernetes pods running in a local network.2

created 2021-10-012 references

All 1 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

CanisterWormS9042 ↗

Has performed environment fingerprinting to identify Kubernetes clusters.1 CanisterWorm has also searched for Kubernetes pods using the command os.path.exists("/var/run/secrets/kubernetes.io/serviceaccount") or "KUBERNETES_SERVICE_HOST" in os.environ .2

created 2026-07-24MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Can identify Docker and Kubernetes environments for credentials.1 2

created 2026-07-01MALWAREcarried by 1 group

PeiratesS0683 ↗

Can enumerate Kubernetes pods in a given namespace.1

created 2022-02-08TOOLcarried by 1 group

HildegardS0601 ↗

Has used masscan to search for kubelets and the kubelet API for additional running containers.1

created 2021-04-07MALWAREcarried by 1 group

All 4 software entries for this technique

Offense vs defense T1613

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

first rule: 2026 Q2

Container and Resource Discovery detection strategy DET0490

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Container and Resource Discovery

Enterprise

1 platform

AN1352 · Containers

Detection of adversary attempts to enumerate containers, pods, nodes, and related resources within containerized environments. Defenders may observe anomalous API calls to Docker or Kubernetes (e.g., 'docker ps', 'kubectl get pods', 'kubectl get nodes'), unusual account activity against the Kubernetes dashboard, or unexpected queries against container metadata endpoints. These events should be correlated with user context and network activity to reveal resource discovery attempts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Pod EnumerationDC0037	kubernetes:apiserver	list or get requests against pods, deployments, or nodes
Container EnumerationDC0091	docker:daemon	docker ps, docker inspect, or docker images commands

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserAllowList	Defines which service accounts and admin roles are expected to perform discovery actions. Activity by non-allowlisted identities may indicate adversary discovery.
TimeWindow	Specifies correlation period (e.g., 10m) for linking multiple discovery attempts across API and daemon logs.
PodQueryThreshold	Defines threshold for number of pod/node enumeration requests by a single user. Excessive queries may indicate scanning activity.

Limit Access to Resource Over NetworkM1035

Limit communications with the container service to managed and secured channels, such as local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API and Kubernetes API Server. In Kubernetes clusters deployed in cloud environments, use native cloud platform features to restrict the IP ranges that are permitted to access to API server. Where possible, consider enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access.

Network SegmentationM1030

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

User Account ManagementM1018

Enforce the principle of least privilege by limiting dashboard visibility to only the required users. When using Kubernetes, avoid giving users wildcard permissions or adding users to the system:masters group, and use RoleBindings rather than ClusterRoleBindings to limit user privileges to specific namespaces.

Tests2Executorssh 2Need elevation0 of 2Have prerequisites2Have cleanup2Platformscontainers

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Docker Container and Resource Discovery	containers	sh	—	2	Yes
Adversaries may attempt to discover containers and other resources that are available within a containers environment. Attack command docker build -t t1613 $PathtoAtomicsFolder/T1613/src/ docker run --name t1613_container --rm -d -t t1613 docker ps docker stats --no-stream docker inspect $(docker ps -l -q --filter ancestor=t1613) Cleanup command docker stop t1613_container docker rmi -f t1613 Prerequisite Verify Docker is installed. Check which docker Satisfy if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi Prerequisite Verify Docker service is running. Check sudo systemctl status docker --no-pager Satisfy sudo systemctl start docker GUIDcd1bd239-d5e5-4516-a456-b87794d9fc4c
02	Podman Container and Resource Discovery	containers	sh	—	2	Yes
Adversaries may attempt to discover containers and other resources that are available within a containers environment. Attack command podman build -t t1613 $PathtoAtomicsFolder/T1613/src/ podman run --name t1613_container --rm -d -t t1613 podman ps podman stats --no-stream podman inspect $(podman ps -l -q --filter ancestor=t1613) Cleanup command podman stop t1613_container podman rmi -f t1613 Prerequisite Verify Podman is installed. Check which podman Satisfy if [ "" == "`which podman`" ]; then echo "Podman Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install podman ; elif [ -n "`which yum`" ]; then sudo yum -y install podman ; elif [ -n "`which pacman`" ]; then sudo pacman -Sy podman --noconfirm ; elif [ -n "`which brew`" ]; then brew install podman ; else echo "Unsupported package manager"; fi ; else echo "Podman installed"; fi Prerequisite Verify Podman service is running. Check sudo systemctl status podman --no-pager Satisfy sudo systemctl start podman GUIDb24f9dbc-e2e6-4b5e-92a7-ffd7d967155b

Tests from Atomic Red Team (MIT licence) · technique definition

Container and Resource Discovery detections T1613

1 rule is mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

42nd pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs