{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1609","id":"T1609","name":"Container Administration Command","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1609","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"96da2ae35f6a37b344cdf896b9f37ae2eab94a82c77bae5b0ed934c9e4776397","description":"Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)\n\nIn Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <code>docker exec</code> to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as <code>kubectl exec</code>.(Citation: Kubectl Exec Get Shell)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1609","external_id":"T1609"},{"source_name":"Docker Exec","description":"Docker. (n.d.). Docker Exec. Retrieved March 29, 2021.","url":"https://docs.docker.com/engine/reference/commandline/exec/"},{"source_name":"Docker Entrypoint","description":"Docker. (n.d.). Docker run reference. Retrieved March 29, 2021.","url":"https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime"},{"source_name":"Docker Daemon CLI","description":"Docker. (n.d.). DockerD CLI. Retrieved March 29, 2021.","url":"https://docs.docker.com/engine/reference/commandline/dockerd/"},{"source_name":"Kubectl Exec Get Shell","description":"The Kubernetes Authors. (n.d.). Get a Shell to a Running Container. Retrieved March 29, 2021.","url":"https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/"},{"source_name":"Kubernetes Kubelet","description":"The Kubernetes Authors. (n.d.). Kubelet. Retrieved March 29, 2021.","url":"https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/"},{"source_name":"Kubernetes API","description":"The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021.","url":"https://kubernetes.io/docs/concepts/overview/kubernetes-api/"}],"platforms":["Containers"],"environments":["containers"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1609","id":"T1609","name":"Container Administration Command","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"source_url":"https://attack.mitre.org/techniques/T1609","technique_page":"techniques/enterprise/T1609/","page":"detections/enterprise/T1609/","status":"rule_source_available","counts":{"sigma":3,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[{"id":"a1b0ca4e-7835-413e-8471-3ff2b8a66be6","title":"Potential Remote Command Execution In Pod Container","status":"test","level":"medium","logsource":{"category":"application","product":"kubernetes","service":"audit"},"data_path":"data/detection-rules/a1b0ca4e-7835-413e-8471-3ff2b8a66be6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_exec_into_container.yml","author":"Leo Tsaousis (@laripping)","kind":"sigma"},{"id":"597a7e84-187d-458b-9e4f-2f5a0e676711","title":"Kubernetes Potential Enumeration Activity","status":"experimental","level":"medium","logsource":{"product":"kubernetes","service":"audit"},"data_path":"data/detection-rules/597a7e84-187d-458b-9e4f-2f5a0e676711.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_potential_enumeration_activity.yml","author":"uniqu3-us3r","kind":"sigma"},{"id":"ad9012a6-e518-4432-9890-f3b82b8fc71f","title":"Potential Sidecar Injection Into Running Deployment","status":"test","level":"medium","logsource":{"category":"application","product":"kubernetes","service":"audit"},"data_path":"data/detection-rules/ad9012a6-e518-4432-9890-f3b82b8fc71f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/kubernetes/audit/kubernetes_audit_sidecar_injection.yml","author":"Leo Tsaousis (@laripping)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1609-1","technique_id":"T1609","title":"T1609 Container Administration Command","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#execution","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":66,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L66","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"7915511628308a0b77fd0a51846736e23cd5156b0593f8752c98b5c832a3b3fd","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(orchestrator_request_subresource = exec) AND actor NOT_IN approved_container_admins -> ALERT","log_sources":[{"title":"Orchestrator Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#121-orchestrator-audit-logs"},{"title":"Container Runtime Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#118-container-runtime-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1609-1","technique_id":"T1609","title":"Container administration interface executes command — T1609 Container Administration Command","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#container-exec","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":47,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L47","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"bfeee9337b468f90b9ce9b81795ee90ac7cbe42f5424f6c74c38d56ca40eb246","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"identity-namespace-workload relationship.","expected_behavior":"a small approved set of identities performs interactive execution in specific namespaces.","deviation":"new identity-to-namespace edge or rare service-account action.","anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"}],"log_sources":[{"title":"Orchestrator Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#121-orchestrator-audit-logs"},{"title":"Container Runtime Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#118-container-runtime-logs"}],"context_references":[{"title":"Sysdig TeamTNT kubelet investigation — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/sysdig-teamtnt-kubelet.html"},{"title":"original source","url":"https://www.sysdig.com/blog/teamtnt-kubelet-credentials/"}]}],"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Rare-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#84-rare-category-anomaly"}],"strategies":[{"id":"DET0065","name":"Detection Strategy for Container Administration Command Abuse","url":"https://attack.mitre.org/detectionstrategies/DET0065","stix_id":"x-mitre-detection-strategy--e9a74ecb-cc65-4c21-ae40-850e3317c248","relationship_id":"relationship--643dc681-2238-46b5-8e00-590eecd638af","description":"","analytics":[{"id":"AN0177","name":"Analytic 0177","guidance":"Defenders may detect abuse of container administration commands by observing anomalous use of management utilities (`docker exec`, `kubectl exec`, or API calls to kubelet) correlated with unexpected process creation inside containers. Behavioral chains include unauthorized API requests followed by command execution within running pods or containers, often originating from unusual user accounts, automation scripts, or IP addresses outside the expected cluster management plane.","url":"https://attack.mitre.org/detectionstrategies/DET0065#AN0177","platforms":["Containers"],"tuning":[{"field":"AuthorizedAdminUsers","description":"Expected admin accounts allowed to use exec commands; anomalies outside this list indicate possible abuse."},{"field":"ExecFrequencyThreshold","description":"Defines how often `docker exec` or `kubectl exec` is normally observed; sudden spikes may indicate adversary behavior."},{"field":"SourceIPRange","description":"Expected IP ranges for management actions (e.g., cluster control plane). Requests from external/unexpected ranges may indicate compromise."},{"field":"NamespaceScope","description":"Defines which namespaces typically allow exec operations; anomalous activity outside these may indicate lateral movement."}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"docker:daemon","channel":"docker exec or docker run with unexpected command/entrypoint","platforms":["Containers"],"analytic_id":"AN0177","source_url":"https://attack.mitre.org/detectionstrategies/DET0065#AN0177","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0032","component":"Process Creation","name":"kubernetes:apiserver","channel":"kubectl exec or kubelet API calls targeting running pods","platforms":["Containers"],"analytic_id":"AN0177","source_url":"https://attack.mitre.org/detectionstrategies/DET0065#AN0177","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0599","name":"Kinsing","url":"https://attack.mitre.org/software/S0599","kind":"malware","description":"[Kinsing](https://attack.mitre.org/software/S0599) was executed with an Ubuntu container entry point that runs shell scripts.(Citation: Aqua Kinsing April 2020)","relationship_id":"relationship--d0dedd7e-d480-4611-b4b2-90f1ba71091b","references":[{"source_name":"Aqua Kinsing April 2020","description":"Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}]},{"id":"S0601","name":"Hildegard","url":"https://attack.mitre.org/software/S0601","kind":"malware","description":"[Hildegard](https://attack.mitre.org/software/S0601) was executed through the kubelet API run command and by executing commands on running containers.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--4428158e-cf07-49f0-8a9f-5cc767027e2a","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"id":"S0623","name":"Siloscape","url":"https://attack.mitre.org/software/S0623","kind":"malware","description":"[Siloscape](https://attack.mitre.org/software/S0623) can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.(Citation: Unit 42 Siloscape Jun 2021)","relationship_id":"relationship--bcee03c4-6420-4280-8212-c8aa44a13730","references":[{"source_name":"Unit 42 Siloscape Jun 2021","description":"Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.","url":"https://unit42.paloaltonetworks.com/siloscape/"}]},{"id":"S0683","name":"Peirates","url":"https://attack.mitre.org/software/S0683","kind":"tool","description":"[Peirates](https://attack.mitre.org/software/S0683) can use `kubectl` or the Kubernetes API to run commands.(Citation: Peirates GitHub)","relationship_id":"relationship--17530a5c-d0a2-4a4d-8617-d0659b443e3a","references":[{"source_name":"Peirates GitHub","description":"InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022.","url":"https://github.com/inguardians/peirates"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can use `kubectl get secrets` to extract credentials from Kubernetes.(Citation: Aqua Security Blog Trivy Compromise APR 2026)","relationship_id":"relationship--aad3b74f-bc6a-4662-9388-e44958c7ba10","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) can deploy privileged DaemonSets in Kubernetes clusters for data wiping using kubectl.(Citation: Palo Alto TeamPCP MAR 2026)(Citation: Aikido CanisterWorm MAR 2026)","relationship_id":"relationship--7529023c-bf57-4cdc-9ccb-d6e56d29e081","references":[{"source_name":"Aikido CanisterWorm MAR 2026","description":"Eriksen, C. (2026, March 22). CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran"},{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has utilized container administration commands to gather details of compromised hosts and gather credentials to include Kubernetes command-line utilities `kubectl get secrets`.(Citation: Trend Micro TeamPCP MAY 2026)(Citation: Phoenix TeamPCP 20 MAY 2026)","relationship_id":"relationship--af573ba3-42c6-497b-8d1c-063a159a4eee","references":[{"source_name":"Trend Micro TeamPCP MAY 2026","description":"Santos, J. and Navato, J.R. (2026, May 13). Analyzing TeamPCP’s Supply Chain Attacks: Checkmarx KICS and elementary-data in CI/CD Credential Theft. Retrieved July 16, 2026.","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source_name":"Phoenix TeamPCP 20 MAY 2026","description":"Webb, M. (2026, May 20). TeamPCP Wave Four: GitHub Breach via Poisoned VS Code Extension, durabletask PyPI Worm, and ~4,000 Internal Repositories Exfiltrated. Retrieved July 16, 2026.","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"id":"S9045","name":"BACKUPOSINT v9.0 APEX PREDATOR","url":"https://attack.mitre.org/software/S9045","kind":"malware","description":"[BACKUPOSINT v9.0 APEX PREDATOR](https://attack.mitre.org/software/S9045) can interact with and execute Docker and Kerberos commands.(Citation: AI-Mexico-Govt-Compromise) ","relationship_id":"relationship--f77c32a3-f696-4dd0-a66b-dc9b765ade46","references":[{"source_name":"AI-Mexico-Govt-Compromise","description":"Jay Deen. (2026, May). AI-Assisted Compromise of Mexican Water Utility with OT Implications. Retrieved September 2, 2026.","url":"https://5943619.hs-sites.com/hubfs/116-Whitepapers/dragos-2026-ai-mexico-water-attack-intel-brief.pdf"}]}],"actors":[{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) executed [Hildegard](https://attack.mitre.org/software/S0601) through the kubelet API run command and by executing commands on running containers.(Citation: Unit 42 Hildegard Malware)","relationship_id":"relationship--12ea5ead-f19a-488e-8b47-ceb9d45593fd","references":[{"source_name":"Unit 42 Hildegard Malware","description":"Chen, J. et al. (2021, February 3). Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes. Retrieved April 5, 2021.","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Enforce authentication and role-based access control on the container service to restrict users to the least privileges required.(Citation: Kubernetes Hardening Guide) When using Kubernetes, avoid giving users wildcard permissions or adding users to the `system:masters` group, and use `RoleBindings` rather than `ClusterRoleBindings` to limit user privileges to specific namespaces.(Citation: Kubernetes RBAC)","relationship_id":"relationship--4d98988c-bac6-48da-9bc8-6e4375317fd4","references":[{"source_name":"Kubernetes RBAC","description":"Kubernetes. (n.d.). Role Based Access Control Good Practices. Retrieved March 8, 2023.","url":"https://kubernetes.io/docs/concepts/security/rbac-good-practices/"},{"source_name":"Kubernetes Hardening Guide","description":"National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022.","url":"https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"}]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Ensure containers are not running as root by default. In Kubernetes environments, consider defining Pod Security Standards that prevent pods from running privileged containers and using the `NodeRestriction` admission controller to deny the kublet access to nodes and pods outside of the node it belongs to.(Citation: Kubernetes Hardening Guide) (Citation: Kubernetes Admission Controllers)","relationship_id":"relationship--9dcf3707-34ff-4a44-b65b-fc1f8f127bf5","references":[{"source_name":"Kubernetes Admission Controllers","description":"Kubernetes. (n.d.). Admission Controllers Reference. Retrieved March 8, 2023.","url":"https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers"},{"source_name":"Kubernetes Hardening Guide","description":"National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022.","url":"https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"}]},{"id":"M1035","name":"Limit Access to Resource Over Network","url":"https://attack.mitre.org/mitigations/M1035","kind":"course-of-action","description":"Limit communications with the container service to managed and secured channels, such as local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API and Kubernetes API Server.(Citation: Docker Daemon Socket Protect)(Citation: Kubernetes API Control Access) In Kubernetes clusters deployed in cloud environments, use native cloud platform features to restrict the IP ranges that are permitted to access to API server.(Citation: Kubernetes Cloud Native Security) Where possible, consider enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access.(Citation: Microsoft AKS Azure AD 2023)","relationship_id":"relationship--d8b7535e-7cf7-408e-acd3-a42fc77a5e35","references":[{"source_name":"Docker Daemon Socket Protect","description":"Docker. (n.d.). Protect the Docker Daemon Socket. Retrieved March 29, 2021.","url":"https://docs.docker.com/engine/security/protect-access/"},{"source_name":"Kubernetes Cloud Native Security","description":"Kubernetes. (n.d.). Overview of Cloud Native Security. Retrieved March 8, 2023.","url":"https://kubernetes.io/docs/concepts/security/overview/"},{"source_name":"Microsoft AKS Azure AD 2023","description":"Microsoft. (2023, February 27). AKS-managed Azure Active Directory integration. Retrieved March 8, 2023.","url":"https://learn.microsoft.com/en-us/azure/aks/managed-aad"},{"source_name":"Kubernetes API Control Access","description":"The Kubernetes Authors. (n.d.). Controlling Access to The Kubernetes API. Retrieved March 29, 2021.","url":"https://kubernetes.io/docs/concepts/security/controlling-access/"}]},{"id":"M1038","name":"Execution Prevention","url":"https://attack.mitre.org/mitigations/M1038","kind":"course-of-action","description":"Use read-only containers, read-only file systems, and minimal images when possible to prevent the execution of commands.(Citation: Kubernetes Hardening Guide) Where possible, also consider using application control and software restriction tools (such as those provided by SELinux) to restrict access to files, processes, and system calls in containers.(Citation: Kubernetes Security Context)","relationship_id":"relationship--fd9cf3cc-51cd-4f13-b90e-2b8e274a4cc1","references":[{"source_name":"Kubernetes Security Context","description":"Kubernetes. (n.d.). Configure a Security Context for a Pod or Container. Retrieved March 8, 2023.","url":"https://kubernetes.io/docs/tasks/configure-pod-container/security-context/"},{"source_name":"Kubernetes Hardening Guide","description":"National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022.","url":"https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"}]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Remove unnecessary tools and software from containers.","relationship_id":"relationship--a3a13b78-f599-4635-8750-2603bf18b370","references":[]}],"candidates":[{"id":"900e2c49-221b-42ec-ae3c-4717e41e6219","name":"Docker Exec Into Container","platforms":["containers"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1609/T1609.yaml","description":"Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“docker exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “docker exec”. Kinsing (Golang-based malware) was executed with an Ubuntu container entry point that runs shell scripts.\n","inputs":{},"dependencies":[{"description":"docker must be installed\n"}],"source_definition_sha256":"38f88d9dfa38319237b64aae2fdfd34e9ca8f3a086bee3414c1031747b24f2a5"},{"id":"d03bfcd3-ed87-49c8-8880-44bb772dea4b","name":"ExecIntoContainer","platforms":["containers"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1609/T1609.yaml","description":"Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“kubectl exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “kubectl exec”.\n","inputs":{"namespace":{"description":"K8s namespace to use","type":"string","default":"default"},"command":{"description":"Command to run","type":"string","default":"uname"},"path":{"description":"Path to busybox.yaml file","type":"string","default":"$PathtoAtomicsFolder/T1609/src/busybox.yaml"}},"dependencies":[{"description":"kubectl must be installed\n"}],"source_definition_sha256":"48fa27c10736ba2ed09591adf70fbb639155fc0589dc7496390b4b4ad2d6a71d"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1609":"/ttp-simulation/techniques/enterprise/T1609/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1609","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}