t1610-deploy-container

name	T1610_deploy-container
description	Adversaries may deploy a container into an environment to facilitate execution or evade defenses.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1610","defense-evasion","execution","containers"]
technique_id	T1610
tactic	defense-evasion
all_tactics	["defense-evasion","execution"]
platforms	["Containers"]
mitre_url	https://attack.mitre.org/techniques/T1610
tech_stack	["containers"]
cwe_ids	["CWE-693"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1610 Deploy Container

High-Level Description

Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to Escape to Host and access other containers running on the node.

Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes. Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.

Kill Chain Phase

• Defense Evasion (TA0005)
• Execution (TA0002)

Platforms: Containers

What to Check

• Identify if Deploy Container technique is applicable to target environment
• Check Containers systems for indicators of Deploy Container
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Deploy Docker container

Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime. They can do this using docker create and docker start commands. Kinsing & Doki was exploited using this technique.

Supported Platforms: containers

docker build -t t1610 $PathtoAtomicsFolder/T1610/src/
docker run --name t1610_container --rm -itd t1610 bash /tmp/script.sh

Dependencies: