t1609-container-administration-command

name	T1609_container-administration-command
description	Adversaries may abuse a container administration service to execute commands within a container.
category	input-validation
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1609","execution","containers"]
technique_id	T1609
tactic	execution
all_tactics	["execution"]
platforms	["Containers"]
mitre_url	https://attack.mitre.org/techniques/T1609
tech_stack	["containers"]
cwe_ids	["CWE-94"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1609 Container Administration Command

High-Level Description

Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.

In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container. In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.

Kill Chain Phase

• Execution (TA0002)

Platforms: Containers

What to Check

• Identify if Container Administration Command technique is applicable to target environment
• Check Containers systems for indicators of Container Administration Command
• Verify mitigations are bypassed or absent (5 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: ExecIntoContainer

Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“kubectl exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “kubectl exec”.

Supported Platforms: containers

kubectl create -f #{path} -n #{namespace}
# wait 3 seconds for the instance to come up
sleep 3
kubectl exec -n #{namespace} busybox -- #{command}

Dependencies:

• kubectl must be installed

Atomic Test 2: Docker Exec Into Container

Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“docker exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “docker exec”. Kinsing (Golang-based malware) was executed with an Ubuntu container entry point that runs shell scripts.