t1059-013-container-cliapi

name	T1059.013_container-cliapi
description	Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1059.013","execution","containers","sub-technique"]
technique_id	T1059.013
tactic	execution
all_tactics	["execution"]
platforms	["Containers"]
mitre_url	https://attack.mitre.org/techniques/T1059/013
tech_stack	["containers"]
cwe_ids	["CWE-94"]
chains_with	["T1059","T1059.001","T1059.002","T1059.003","T1059.004","T1059.005","T1059.006","T1059.007","T1059.008","T1059.009","T1059.010","T1059.011","T1059.012"]
prerequisites	["T1059"]
severity_boost	{"T1059":"Chain with T1059 for deeper attack path","T1059.001":"Chain with T1059.001 for deeper attack path","T1059.002":"Chain with T1059.002 for deeper attack path"}

T1059.013 Container CLI/API

Sub-technique of: T1059

High-Level Description

Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments.

The Docker CLI is used for managing containers via an exposed API point from the dockerd daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose, but users are also able to use SDKs to interact with the API. For example, Docker SDK for Python can be used to run commands within a Python application.

Adversaries may leverage the Docker CLI, API, or SDK to pull or build Docker images (i.e., Ingress Tool Transfer, Build Image on Host), run containers (i.e., Deploy Container), or execute commands inside running containers (i.e., Container Administration Command). In some cases, threat actors may pull legitimate images that include scripts or tools that they can leverage - for example, using an image that includes the curl command to download payloads. Adversaries may also utilize docker inspect and docker ps to scan for cloud environment variables and other running containers (i.e., Container and Resource Discovery).

Kubernetes is responsible for the management and orchestration of containers across clusters. The Kubernetes control plane, which manages the state of the cluster and is responsible for scheduling, communication, and resource monitoring, can be invoked directly via the API or indirectly via CLI tools such as kubectl. It may also be accessed within client libraries such as Go or Python. By utilizing the API, administrators can interact with resources within the cluster such as listing or creating pods, which is a group of one or more containers. Adversaries call the API server via curl or other tools, allowing them to obtain further information about the environment such as pods, deployments, daemonsets, namespaces, or sysvars. They may also run various commands regarding resource management.

Kill Chain Phase

• Execution (TA0002)

Platforms: Containers

What to Check

• Identify if Container CLI/API technique is applicable to target environment
• Check Containers systems for indicators of Container CLI/API
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test