T1613 · Container and Resource Discovery · MITRE ATT&CK

Container and Resource Discovery MITRE reference T1613

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamTNTG0139 ↗

Has checked for running containers with docker ps and for specific container names with docker inspect.1 TeamTNT has also searched for Kubernetes pods running in a local network.2

created 2021-10-012 references

All 1 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

CanisterWormS9042 ↗

Has performed environment fingerprinting to identify Kubernetes clusters.1 CanisterWorm has also searched for Kubernetes pods using the command os.path.exists("/var/run/secrets/kubernetes.io/serviceaccount") or "KUBERNETES_SERVICE_HOST" in os.environ .2

created 2026-07-24MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Can identify Docker and Kubernetes environments for credentials.1 2

created 2026-07-01MALWAREcarried by 1 group

PeiratesS0683 ↗

Can enumerate Kubernetes pods in a given namespace.1

created 2022-02-08TOOLcarried by 1 group

HildegardS0601 ↗

Has used masscan to search for kubelets and the kubelet API for additional running containers.1

created 2021-04-07MALWAREcarried by 1 group

All 4 software entries for this technique

Offense vs defense T1613

Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.

Range

Technique Campaign use over its cumulative rule count.

Campaigns · 0Sigma rules (cumulative) · 1Splunk ESCU (cumulative) · 0

Container and Resource Discovery detection strategy DET0490

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Container and Resource Discovery

Enterprise

1 platform

AN1352 · Containers

Detection of adversary attempts to enumerate containers, pods, nodes, and related resources within containerized environments. Defenders may observe anomalous API calls to Docker or Kubernetes (e.g., 'docker ps', 'kubectl get pods', 'kubectl get nodes'), unusual account activity against the Kubernetes dashboard, or unexpected queries against container metadata endpoints. These events should be correlated with user context and network activity to reveal resource discovery attempts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Pod EnumerationDC0037	kubernetes:apiserver	list or get requests against pods, deployments, or nodes
Container EnumerationDC0091	docker:daemon	docker ps, docker inspect, or docker images commands

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserAllowList	Defines which service accounts and admin roles are expected to perform discovery actions. Activity by non-allowlisted identities may indicate adversary discovery.
TimeWindow	Specifies correlation period (e.g., 10m) for linking multiple discovery attempts across API and daemon logs.
PodQueryThreshold	Defines threshold for number of pod/node enumeration requests by a single user. Excessive queries may indicate scanning activity.

Limit Access to Resource Over NetworkM1035

Limit communications with the container service to managed and secured channels, such as local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API and Kubernetes API Server. In Kubernetes clusters deployed in cloud environments, use native cloud platform features to restrict the IP ranges that are permitted to access to API server. Where possible, consider enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access.

Network SegmentationM1030

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

User Account ManagementM1018

Enforce the principle of least privilege by limiting dashboard visibility to only the required users. When using Kubernetes, avoid giving users wildcard permissions or adding users to the system:masters group, and use RoleBindings rather than ClusterRoleBindings to limit user privileges to specific namespaces.

Tests2Executorssh 2Need elevation0 of 2Have prerequisites2Have cleanup2Platformscontainers

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup
01	Docker Container and Resource Discovery	containers	sh	—	2	Yes
Adversaries may attempt to discover containers and other resources that are available within a containers environment. Attack Commandsrun with `sh` docker build -t t1613 $PathtoAtomicsFolder/T1613/src/ docker run --name t1613_container --rm -d -t t1613 docker ps docker stats --no-stream docker inspect $(docker ps -l -q --filter ancestor=t1613) Cleanup Commands docker stop t1613_container docker rmi -f t1613 Dependenciesrun with `sh` Description Verify Docker is installed. Check Prereq Commands which docker Get Prereq Commands if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi Description Verify Docker service is running. Check Prereq Commands sudo systemctl status docker --no-pager Get Prereq Commands sudo systemctl start docker GUIDea2255df-d781-493b-9693-ac328f9afc3f
02	Podman Container and Resource Discovery	containers	sh	—	2	Yes
Adversaries may attempt to discover containers and other resources that are available within a containers environment. Attack Commandsrun with `sh` podman build -t t1613 $PathtoAtomicsFolder/T1613/src/ podman run --name t1613_container --rm -d -t t1613 podman ps podman stats --no-stream podman inspect $(podman ps -l -q --filter ancestor=t1613) Cleanup Commands podman stop t1613_container podman rmi -f t1613 Dependenciesrun with `sh` Description Verify Podman is installed. Check Prereq Commands which podman Get Prereq Commands if [ "" == "`which podman`" ]; then echo "Podman Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install podman ; elif [ -n "`which yum`" ]; then sudo yum -y install podman ; elif [ -n "`which pacman`" ]; then sudo pacman -Sy podman --noconfirm ; elif [ -n "`which brew`" ]; then brew install podman ; else echo "Unsupported package manager"; fi ; else echo "Podman installed"; fi Description Verify Podman service is running. Check Prereq Commands sudo systemctl status podman --no-pager Get Prereq Commands sudo systemctl start podman GUIDfc631702-3f03-4f2b-8d8a-6b3d055580a1

Tests from Atomic Red Team (MIT licence) · technique definition

Container and Resource Discovery detections T1613

1 rule is mapped to this technique.

42nd pctamong all ATT&CK techniques for number of rules

Showing 1-1 of 1 rules

Drag headers to reorder | Drag edges to resize

Select	Title	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
		Detects potential Kubernetes enumeration or attack activity via the audit log. (...)	Generic	experimental	-	-	Kubernetes Audit · Kubernetes	Execution Container Administration Command Discovery Container and Resource Discovery	-	medium	uniqu3-us3r	2026-04-28	—	597a7e84-187d-458b-9e4f-2f5a0e676711

Container and Resource Discovery T1613

Container and Resource Discovery T1613

Container and Resource Discovery MITRE reference T1613

Offense vs defense T1613

Container and Resource Discovery detection strategy DET0490

Detection Strategy for Container and Resource Discovery

Log sources

Tunable fields

Container and Resource Discovery MITRE reference T1613

Offense vs defense T1613

Container and Resource Discovery detection strategy DET0490

Detection Strategy for Container and Resource Discovery

Log sources

Tunable fields

Container and Resource Discovery detections T1613

Container and Resource Discovery detections T1613