| name | T1613_container-and-resource-discovery |
| description | Adversaries may attempt to discover containers and other resources that are available within a containers environment. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1613","discovery","containers"] |
| technique_id | T1613 |
| tactic | discovery |
| all_tactics | ["discovery"] |
| platforms | ["Containers"] |
| mitre_url | https://attack.mitre.org/techniques/T1613 |
| tech_stack | ["containers"] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
T1613 Container and Resource Discovery
High-Level Description
Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.
These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs. In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Kill Chain Phase
Platforms: Containers
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Docker Container and Resource Discovery
Adversaries may attempt to discover containers and other resources that are available within a containers environment.
Supported Platforms: containers
docker build -t t1613 $PathtoAtomicsFolder/T1613/src/
docker run --name t1613_container --rm -d -t t1613
docker ps
docker stats --no-stream
docker inspect $(docker ps -l -q --filter ancestor=t1613)
Dependencies:
- Verify Docker is installed.
- Verify Docker service is running.
Atomic Test 2: Podman Container and Resource Discovery
Adversaries may attempt to discover containers and other resources that are available within a containers environment.
Supported Platforms: containers
podman build -t t1613 /T1613/src/
podman run --name t1613_container -- -d -t t1613
podman ps
podman stats --no-stream
podman inspect $(podman ps -l -q --filter ancestor=t1613)
