T1552.007 Container API — Detection Rules

Source-backed rule directory

• Kubernetes Admission Controller Modification · test · medium · {"product":"kubernetes","service":"audit"}
• Kubernetes Secrets Enumeration · test · low · {"category":"application","product":"kubernetes","service":"audit"}
• Azure Kubernetes Admission Controller · test · medium · {"product":"azure","service":"activitylogs"}
• Google Cloud Kubernetes Admission Controller · test · medium · {"product":"gcp","service":"gcp.audit"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0198 Detect Abuse of Container APIs for Credential Access

AN0571 Analytic 0571

Detection correlates anomalous Docker or Kubernetes API requests with access to logs, secrets, or service accounts. Observes unauthorized use of `docker logs`, `kubectl get secrets`, or direct API calls to Kubernetes API server endpoints. Identifies behavioral patterns where adversaries escalate from basic pod/container interaction to privileged API calls exposing sensitive credential material.