1200KM / detection
Detection workspace for T1610 Deploy Container: 0 Sigma sources, 1 Atlas concepts and 1 anomaly models. No live detection validation.
No reviewed association in this snapshot.
MATCH(workload_created) AND (image NOT_IN approved_images OR privileged = true OR host_mount = true) -> ALERTComparison unit: deployer-image-namespace-runtime configuration.
Expected behavior: peer workloads use approved images and recurring privilege profiles.
Deviation: rare combination of privilege, image, mounts, identity, and namespace.
Remote/API driven creation **and** start of a container whose image is not on an allow‑list (or is tagged `latest`), executed by a non-admin principal, and/or started with risky runtime attributes (e.g., `--privileged`, host PID/NET namespaces, sensitive host path mounts, capability adds). Correlates *create* ➜ *start* ➜ first network/process actions from that container within a short time window.
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Collection configuration and event examples · Anomaly models and design worksheet · Tools and documented software · Simulation procedures · Offline synthetic collection check
Exact source tags are not semantic relevance verdicts. Review actual rule conditions and observation points; imported rules are not backend-compiled or live-validated.
Curated research views reached through an exact source technique, a catalog model, or a reviewed collection reference. These are navigation associations, not claims of detector effectiveness or sensor equivalence.
Telemetry contracts · Maintained query examples · Validation and blind spots
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.