1200KM / detection
T1059.013 Container CLI/API — Detection Rules
Detection workspace for T1059.013 Container CLI/API: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0083 Container CLI and API Abuse via Docker/Kubernetes (T1059.013)
AN0233 Analytic 0233
Execution of container orchestration commands (e.g., `docker exec`, `kubectl exec`) or API-driven interactions with running containers from unauthorized hosts or non-standard user contexts. Defender sees programmatic or interactive command execution within containers outside expected CI/CD tools or automation frameworks, often followed by file writes, privilege escalation, or lateral discovery.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1059.013 simulation workspace
- Command Execution · DC0064
- Container Creation · DC0072
- Container Start · DC0077
- Pod Creation · DC0019
- Process Creation · DC0032
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.