{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1610","id":"T1610","name":"Deploy Container","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1610","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"5744b4c7cb0d13efdad8b8910ecaf8fcde1a00353bbaef9b3d8be92f523acb11","description":"Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)\n\nContainers can be deployed by various means, such as via Docker's <code>create</code> and <code>start</code> APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Container)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1610","external_id":"T1610"},{"source_name":"AppSecco Kubernetes Namespace Breakout 2020","description":"Abhisek Datta. (2020, March 18). Kubernetes Namespace Breakout using Insecure Host Path Volume — Part 1. Retrieved January 16, 2024.","url":"https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216"},{"source_name":"Aqua Build Images on Hosts","description":"Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021.","url":"https://blog.aquasec.com/malicious-container-image-docker-container-host"},{"source_name":"Docker Container","description":"DockerDocs. (n.d.). Retrieved December 8, 2025.","url":"https://docs.docker.com/reference/cli/docker/container/create/"},{"source_name":"Kubernetes Workload Management","description":"Kubernetes. (n.d.). Workload Management. Retrieved March 28, 2024.","url":"https://kubernetes.io/docs/concepts/workloads/controllers/"},{"source_name":"Kubeflow Pipelines","description":"The Kubeflow Authors. (n.d.). Overview of Kubeflow Pipelines. Retrieved March 29, 2021.","url":"https://www.kubeflow.org/docs/components/pipelines/overview/pipelines-overview/"},{"source_name":"Kubernetes Dashboard","description":"The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard). Retrieved March 29, 2021.","url":"https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/"}],"platforms":["Containers"],"environments":["containers"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0038","name":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component","category":"Application and service audit","description":"Application-emitted audit or operational event content.","collection_focus":"Select the application event family required by the detection and document its native schema before normalization.","providers":[{"name":"Application audit logs","scope":"First-party service events and request/result fields; schema is application-specific.","source_id":"otel"},{"name":"OpenTelemetry-compatible log pipelines","scope":"Transport and normalization of emitted records; do not create missing audit instrumentation.","source_id":"otel"}],"configuration":["Enable the application audit category or instrument the owned lab application at the authorization/action boundary.","Define a schema with timestamp, service, actor, object, action, result and correlation ID. Export structured records through an authenticated collector.","Redact secrets and personal content, separate audit from debug logs, set retention and verify delivery during rotation/restart."],"configuration_example":null,"required_fields":["service","action","actor","record_count","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Debug output is not necessarily a durable audit trail. Application developers must emit the relevant event; installing a log pipeline does not make an absent event exist.","sources":[{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per application, client and route: request rate, rare actions, failure ratios and unusual state transitions. Version changes, retries, health probes and seasonal load need separate baselines."},{"id":"DC0077","name":"Container Start","page":"telemetry/DC0077/","kind":"attack_component","category":"Container runtime","description":"A runtime container entering the started state.","collection_focus":"Collect runtime start events and join creation, image and later process activity. An orchestrator request alone is insufficient.","providers":[{"name":"Docker Engine events","scope":"Daemon lifecycle events for containers and images; collect continuously.","source_id":"docker"},{"name":"Kubernetes API audit","scope":"Control-plane context in Kubernetes, not a replacement for runtime observations.","source_id":"k8s"}],"configuration":["Subscribe to the lab daemon event stream with filters for the relevant object/action; send it to a durable collector.","Record runtime/container ID, image digest, action, timestamp and host. Join orchestrator identities where available.","Use a protected collector connection. Docker socket access is privileged; never expose it publicly or grant it to the website."],"configuration_example":null,"required_fields":["container_id","action","runtime"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0077","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","action":"start","runtime":"lab-docker"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Runtime event history is bounded and can be lost without continuous collection. Image tags are mutable; pin digests. A lifecycle event is not a full process or file audit.","sources":[{"id":"docker","title":"Docker engine event stream","url":"https://docs.docker.com/reference/cli/docker/system/events/"},{"id":"k8s","title":"Kubernetes audit policies and backends","url":"https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/"}],"association":"attack_component","anomaly_design":"Per workload image and namespace: rare process starts, unexpected image/privilege changes and new network relationships. Use workload/deployment identity, not short-lived container IDs alone."},{"id":"DC0085","name":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component","category":"Network and protocol telemetry","description":"Packet or decoded application-protocol content visible at a network sensor.","collection_focus":"Scope approved packet capture/protocol content collection to the lab flow; retain capture provenance and truncation indicators.","providers":[{"name":"Zeek","scope":"Connection and protocol metadata from traffic visible to the sensor.","source_id":"zeek"},{"name":"Suricata EVE","scope":"Configured flow, alert, DNS, HTTP, TLS and protocol records.","source_id":"suricata"}],"configuration":["Use an authorized lab TAP/SPAN, virtual mirror or gateway interface. Define which traffic crosses it; avoid assuming visibility into every segment.","Enable the required Zeek analyzers or Suricata EVE event types. Export logs with sensor identity, clock synchronization and flow correlation identifiers.","Monitor capture loss, truncation and exporter sampling. Capture payload only with approval and restrictive retention; encryption normally prevents plaintext inspection."],"configuration_example":null,"required_fields":["flow_id","protocol","method","path","payload_excerpt"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Flows are not packet payloads. NAT, asymmetric routes, encryption, missing mirrors and sampling can hide attribution or content. A destination connection alone does not prove malicious intent.","sources":[{"id":"zeek","title":"Zeek protocol and connection logs","url":"https://docs.zeek.org/en/current/reference/logs/index.html"},{"id":"zeek_start","title":"Zeek capture setup","url":"https://docs.zeek.org/en/current/quickstart.html"},{"id":"suricata","title":"Suricata EVE JSON output","url":"https://docs.suricata.io/en/latest/output/eve/eve-json-output.html"}],"association":"attack_component","anomaly_design":"Per source and observation point: connection rate, destination-host/port fan-out, response/failure ratio and previously unseen destinations. Compare equivalent time windows; separate authorized scanners, NAT and sampling effects."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1610","id":"T1610","name":"Deploy Container","domain":"enterprise","platforms":["Containers"],"environments":["containers"],"source_url":"https://attack.mitre.org/techniques/T1610","technique_page":"techniques/enterprise/T1610/","page":"detections/enterprise/T1610/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[{"id":"atlas-basic-t1610-1","technique_id":"T1610","title":"T1610 Deploy Container","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#persistence","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":79,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L79","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"b48e8ce5656d872c69e73d74f0dea0336177290a18fdf5ad7fcfbd0f91dc96b2","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(workload_created) AND (image NOT_IN approved_images OR privileged = true OR host_mount = true) -> ALERT","log_sources":[{"title":"Orchestrator Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#121-orchestrator-audit-logs"},{"title":"Container Image Registry Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#120-container-image-registry-logs"},{"title":"Container Admission-Control Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#125-container-admission-control-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1610-1","technique_id":"T1610","title":"Privileged or long-running container workload deployed — T1610 Deploy Container","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#privileged-container","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":59,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L59","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"53dbf11377f936ffae806a8bcb27d4f3034744bef3e9d0eb22fd7e780ef23010","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"deployer-image-namespace-runtime configuration.","expected_behavior":"peer workloads use approved images and recurring privilege profiles.","deviation":"rare combination of privilege, image, mounts, identity, and namespace.","anomaly_types":[{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"}],"log_sources":[{"title":"Orchestrator Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#121-orchestrator-audit-logs"},{"title":"Container Runtime Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#118-container-runtime-logs"},{"title":"Container Image Registry Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#120-container-image-registry-logs"}],"context_references":[{"title":"Sysdig SCARLETEEL 2.0 ATT&CK analysis — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/sysdig-scarleteel-mitre.html"},{"title":"original source","url":"https://www.sysdig.com/blog/scarleteel-mitre-attack"}]}],"anomaly_types":[{"title":"Multivariate Combination Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#48-multivariate-combination-anomaly"},{"title":"Novel-Category Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#85-novel-category-anomaly"},{"title":"Peer-Group Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#8-peer-group-anomaly"}],"strategies":[{"id":"DET0249","name":"Behavior-chain detection for T1610 Deploy Container across Docker & Kubernetes control/node planes","url":"https://attack.mitre.org/detectionstrategies/DET0249","stix_id":"x-mitre-detection-strategy--994c7fc6-ad85-47e6-9079-fb872ec7e541","relationship_id":"relationship--51ae0fd9-6c66-4f7f-94ec-734259ba9140","description":"","analytics":[{"id":"AN0693","name":"Analytic 0693","guidance":"Remote/API driven creation **and** start of a container whose image is not on an allow‑list (or is tagged `latest`), executed by a non-admin principal, and/or started with risky runtime attributes (e.g., `--privileged`, host PID/NET namespaces, sensitive host path mounts, capability adds). Correlates *create* ➜ *start* ➜ first network/process actions from that container within a short time window.","url":"https://attack.mitre.org/detectionstrategies/DET0249#AN0693","platforms":["Containers"],"tuning":[{"field":"known_images","description":"Environment-specific allow-list of approved images (with digests)."},{"field":"known_admins","description":"Service accounts or CI/CD users permitted to deploy containers."},{"field":"TimeWindow","description":"Max time between create, start, and first activity to consider events causally linked (default 5m)."},{"field":"RiskThreshold","description":"Minimum number of risky attributes (e.g., unknown image + privileged) to alert."},{"field":"PrivilegedFlags","description":"Set of runtime flags considered high risk (e.g., --privileged, --cap-add=SYS_ADMIN, hostPID, hostNetwork, /var/run/docker.sock mount)."}],"log_sources":[{"component_id":"DC0038","component":"Application Log Content","name":"docker:daemon","channel":"container_create,container_start","platforms":["Containers"],"analytic_id":"AN0693","source_url":"https://attack.mitre.org/detectionstrategies/DET0249#AN0693","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0038/"},{"component_id":"DC0077","component":"Container Start","name":"containerd:runtime","channel":"CRI CreateContainer/StartContainer with privileged=true OR added capabilities OR host* namespaces","platforms":["Containers"],"analytic_id":"AN0693","source_url":"https://attack.mitre.org/detectionstrategies/DET0249#AN0693","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0077/"},{"component_id":"DC0032","component":"Process Creation","name":"ebpf:syscalls","channel":"process execution or network connect from just-created container PID namespace","platforms":["Containers"],"analytic_id":"AN0693","source_url":"https://attack.mitre.org/detectionstrategies/DET0249#AN0693","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0085","component":"Network Traffic Content","name":"docker:events","channel":"remote API calls to /containers/create or /containers/{id}/start","platforms":["Containers"],"analytic_id":"AN0693","source_url":"https://attack.mitre.org/detectionstrategies/DET0249#AN0693","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0085/"}]}]}],"telemetry_references":[{"id":"DC0038","name":"Application Log Content","tag":"Application Log Content","page":"telemetry/DC0038/","kind":"attack_component"},{"id":"DC0077","name":"Container Start","tag":"Container Start","page":"telemetry/DC0077/","kind":"attack_component"},{"id":"DC0085","name":"Network Traffic Content","tag":"Network Traffic Content","page":"telemetry/DC0085/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0683","name":"Peirates","page":"tools/S0683/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0599","name":"Kinsing","url":"https://attack.mitre.org/software/S0599","kind":"malware","description":"[Kinsing](https://attack.mitre.org/software/S0599) was run through a deployed Ubuntu container.(Citation: Aqua Kinsing April 2020)","relationship_id":"relationship--102ece09-4129-4662-b05c-243709cd7d1d","references":[{"source_name":"Aqua Kinsing April 2020","description":"Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}]},{"id":"S0600","name":"Doki","url":"https://attack.mitre.org/software/S0600","kind":"malware","description":"[Doki](https://attack.mitre.org/software/S0600) was run through a deployed container.(Citation: Intezer Doki July 20)","relationship_id":"relationship--78f508b9-0b72-4825-a076-9924eb9291fe","references":[{"source_name":"Intezer Doki July 20","description":"Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}]},{"id":"S0683","name":"Peirates","url":"https://attack.mitre.org/software/S0683","kind":"tool","description":"[Peirates](https://attack.mitre.org/software/S0683) can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.(Citation: Peirates GitHub)","relationship_id":"relationship--71d8ce83-3410-4bf2-b30c-a3aa4c8a931d","references":[{"source_name":"Peirates GitHub","description":"InGuardians. (2022, January 5). Peirates GitHub. Retrieved February 8, 2022.","url":"https://github.com/inguardians/peirates"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can deploy a pod in Kubernetes containers to run a script to establish persistence.(Citation: Wiz TeamPCP KICS MAR 2026)","relationship_id":"relationship--32fce5a7-7893-4da5-910d-5fd50d1a4248","references":[{"source_name":"Wiz TeamPCP KICS MAR 2026","description":"McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}]}],"actors":[{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has deployed different types of containers into victim environments to facilitate execution.(Citation: Intezer TeamTNT September 2020)(Citation: Trend Micro TeamTNT) [TeamTNT](https://attack.mitre.org/groups/G0139) has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--3e62e520-0104-4be7-b4e2-d68fa88d7067","references":[{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source_name":"Trend Micro TeamTNT","description":"Fiser, D. Oliveira, A. (n.d.). Tracking the Activities of TeamTNT A Closer Look at a Cloud-Focused Malicious Actor Group. Retrieved September 22, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"},{"source_name":"Intezer TeamTNT September 2020","description":"Fishbein, N. (2020, September 8). Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks. Retrieved September 22, 2021.","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"}]},{"id":"G1045","name":"Salt Typhoon","url":"https://attack.mitre.org/groups/G1045","kind":"intrusion-set","description":"[Salt Typhoon](https://attack.mitre.org/groups/G1045) has enabled Linux containers in victim network device environments using `guestshell enable`.(Citation: CISA_AA25-239ASaltTyphoon_Sept2025) ","relationship_id":"relationship--25746c12-2e93-4b62-bc08-b0108b37252e","references":[{"source_name":"CISA_AA25-239ASaltTyphoon_Sept2025","description":"CISA. (2025, September 3). Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage System. Retrieved September 22, 2026.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-239a"}]},{"id":"G1056","name":"TeamPCP","url":"https://attack.mitre.org/groups/G1056","kind":"intrusion-set","description":"[TeamPCP](https://attack.mitre.org/groups/G1056) has deployed privileged DaemonSets to delete files on targeted Kubernetes clusters.(Citation: Palo Alto TeamPCP MAR 2026)","relationship_id":"relationship--c0902604-d508-4945-8343-87bb96789c60","references":[{"source_name":"Palo Alto TeamPCP MAR 2026","description":"Unit 42. (2026, March 31). Weaponizing the Protectors: TeamPCP’s Multi-Stage Supply Chain Attack on Security Infrastructure. Retrieved July 1, 2026.","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Enforce the principle of least privilege by limiting container dashboard access to only the necessary users. When using Kubernetes, avoid giving users wildcard permissions or adding users to the `system:masters` group, and use `RoleBindings` rather than `ClusterRoleBindings` to limit user privileges to specific namespaces.(Citation: Kubernetes RBAC)","relationship_id":"relationship--264f59d1-abb8-4f79-8a32-49879700af15","references":[{"source_name":"Kubernetes RBAC","description":"Kubernetes. (n.d.). Role Based Access Control Good Practices. Retrieved March 8, 2023.","url":"https://kubernetes.io/docs/concepts/security/rbac-good-practices/"}]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.","relationship_id":"relationship--6f3caebf-2c07-45de-b2f3-622dc8fcf59e","references":[]},{"id":"M1035","name":"Limit Access to Resource Over Network","url":"https://attack.mitre.org/mitigations/M1035","kind":"course-of-action","description":"Limit communications with the container service to managed and secured channels, such as local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API, Kubernetes API Server, and container orchestration web applications.(Citation: Docker Daemon Socket Protect)(Citation: Kubernetes API Control Access) In Kubernetes clusters deployed in cloud environments, use native cloud platform features to restrict the IP ranges that are permitted to access to API server.(Citation: Kubernetes Cloud Native Security) Where possible, consider enabling just-in-time (JIT) access to the Kubernetes API to place additional restrictions on access.(Citation: Microsoft AKS Azure AD 2023)","relationship_id":"relationship--9e87accb-6851-4438-8673-e3682dae807f","references":[{"source_name":"Docker Daemon Socket Protect","description":"Docker. (n.d.). Protect the Docker Daemon Socket. Retrieved March 29, 2021.","url":"https://docs.docker.com/engine/security/protect-access/"},{"source_name":"Kubernetes Cloud Native Security","description":"Kubernetes. (n.d.). Overview of Cloud Native Security. Retrieved March 8, 2023.","url":"https://kubernetes.io/docs/concepts/security/overview/"},{"source_name":"Microsoft AKS Azure AD 2023","description":"Microsoft. (2023, February 27). AKS-managed Azure Active Directory integration. Retrieved March 8, 2023.","url":"https://learn.microsoft.com/en-us/azure/aks/managed-aad"},{"source_name":"Kubernetes API Control Access","description":"The Kubernetes Authors. (n.d.). Controlling Access to The Kubernetes API. Retrieved March 29, 2021.","url":"https://kubernetes.io/docs/concepts/security/controlling-access/"}]},{"id":"M1047","name":"Audit","url":"https://attack.mitre.org/mitigations/M1047","kind":"course-of-action","description":"Scan images before deployment, and block those that are not in compliance with security policies. In Kubernetes environments, the admission controller can be used to validate images after a container deployment request is authenticated but before the container is deployed.(Citation: Kubernetes Hardening Guide)","relationship_id":"relationship--4eda0bd3-66e3-4773-9616-78ab8f60cbd5","references":[{"source_name":"Kubernetes Hardening Guide","description":"National Security Agency, Cybersecurity and Infrastructure Security Agency. (2022, March). Kubernetes Hardening Guide. Retrieved April 1, 2022.","url":"https://media.defense.gov/2022/Aug/29/2003066362/-1/-1/0/CTR_KUBERNETES_HARDENING_GUIDANCE_1.2_20220829.PDF"}]}],"candidates":[{"id":"59aa6f26-7620-417e-9318-589e0fb7a372","name":"Deploy Docker container","platforms":["containers"],"method":"automated","executor":"bash","elevation_required":false,"dependency_count":2,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1610/T1610.yaml","description":"Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime. They can do this using docker create and docker start commands. Kinsing & Doki was exploited using this technique. \n","inputs":{},"dependencies":[{"description":"Verify docker is installed."},{"description":"Verify docker service is running."}],"source_definition_sha256":"0722b0fce4a32602a0522578badf598d8cd69f069d92451ad9f332c05a28e680"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1611":"/ttp-simulation/techniques/enterprise/T1611/","T1610":"/ttp-simulation/techniques/enterprise/T1610/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1610","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0038","collector":"illustrative-lab-collector","observation":{"service":"lab-portal","action":"export_requested","actor":"lab-reader","record_count":3,"result":"authorized"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0077","collector":"illustrative-lab-collector","observation":{"container_id":"lab-container-1","action":"start","runtime":"lab-docker"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0085","collector":"illustrative-lab-collector","observation":{"flow_id":"lab-flow-1","protocol":"http","method":"GET","path":"/lab-check","payload_excerpt":"LAB_TELEMETRY_CHECK"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}