Containers — platform tag

Meaning and evidence boundary

Navigation membership is based on explicit metadata in this pinned module, not a claim of detection effectiveness or live validation.

Related pages

• Active Directory Object Modification · telemetry
• Application Log Content · telemetry
• Cloud Service Enumeration · telemetry
• Cloud Service Metadata · telemetry
• Cloud Service Modification · telemetry
• Cloud Storage Access · telemetry
• Cloud Storage Deletion · telemetry
• Command Execution · telemetry
• Container Creation · telemetry
• Container Enumeration · telemetry
• Container Start · telemetry
• Driver Load · telemetry
• File Access · telemetry
• File Creation · telemetry
• File Deletion · telemetry
• File Metadata · telemetry
• File Modification · telemetry
• Host Status · telemetry
• Image Creation · telemetry
• Image Metadata · telemetry
• Image Modification · telemetry
• Instance Creation · telemetry
• Instance Start · telemetry
• Kernel Module Load · telemetry
• Logon Session Creation · telemetry
• Logon Session Metadata · telemetry
• Module Load · telemetry
• Network Connection Creation · telemetry
• Network Traffic Content · telemetry
• Network Traffic Flow · telemetry
• OS API Execution · telemetry
• Peirates · tool
• Pod Creation · telemetry
• Pod Enumeration · telemetry
• Process Access · telemetry
• Process Creation · telemetry
• Process Metadata · telemetry
• Process Modification · telemetry
• Process Termination · telemetry
• Scheduled Job Creation · telemetry
• Scheduled Job Modification · telemetry
• Service Creation · telemetry
• Service Metadata · telemetry
• Service Modification · telemetry
• Snapshot Deletion · telemetry
• T1036 Masquerading · simulation
• T1036 Masquerading detections · detection
• T1036.005 Match Legitimate Resource Name or Location · simulation
• T1036.005 Match Legitimate Resource Name or Location detections · detection
• T1036.010 Masquerade Account Name · simulation
• T1036.010 Masquerade Account Name detections · detection
• T1046 Network Service Discovery · simulation
• T1046 Network Service Discovery detections · detection
• T1053 Scheduled Task/Job · simulation
• T1053 Scheduled Task/Job detections · detection
• T1053.007 Container Orchestration Job · simulation
• T1053.007 Container Orchestration Job detections · detection
• T1059 Command and Scripting Interpreter · simulation
• T1059 Command and Scripting Interpreter detections · detection
• T1059.013 Container CLI/API · simulation
• T1059.013 Container CLI/API detections · detection
• T1068 Exploitation for Privilege Escalation · simulation
• T1068 Exploitation for Privilege Escalation detections · detection
• T1069 Permission Groups Discovery · simulation
• T1069 Permission Groups Discovery detections · detection
• T1070 Indicator Removal · simulation
• T1070 Indicator Removal detections · detection
• T1078 Valid Accounts · simulation
• T1078 Valid Accounts detections · detection
• T1078.001 Default Accounts · simulation
• T1078.001 Default Accounts detections · detection
• T1078.003 Local Accounts · simulation
• T1078.003 Local Accounts detections · detection
• T1098 Account Manipulation · simulation
• T1098 Account Manipulation detections · detection
• T1098.006 Additional Container Cluster Roles · simulation
• T1098.006 Additional Container Cluster Roles detections · detection
• T1110 Brute Force · simulation
• T1110 Brute Force detections · detection
• T1110.001 Password Guessing · simulation
• T1110.001 Password Guessing detections · detection
• T1110.003 Password Spraying · simulation
• T1110.003 Password Spraying detections · detection
• T1110.004 Credential Stuffing · simulation
• T1110.004 Credential Stuffing detections · detection
• T1133 External Remote Services · simulation
• T1133 External Remote Services detections · detection
• T1136 Create Account · simulation
• T1136 Create Account detections · detection
• T1136.001 Local Account · simulation
• T1136.001 Local Account detections · detection
• T1190 Exploit Public-Facing Application · simulation
• T1190 Exploit Public-Facing Application detections · detection
• T1195.002 Compromise Software Supply Chain · simulation
• T1204 User Execution · simulation
• T1204 User Execution detections · detection
• T1204.003 Malicious Image · simulation
• T1204.003 Malicious Image detections · detection
• T1485 Data Destruction · simulation
• T1485 Data Destruction detections · detection
• T1490 Inhibit System Recovery · simulation
• T1490 Inhibit System Recovery detections · detection
• T1496 Resource Hijacking · simulation
• T1496 Resource Hijacking detections · detection
• T1496.001 Compute Hijacking · simulation
• T1496.001 Compute Hijacking detections · detection
• T1496.002 Bandwidth Hijacking · simulation
• T1496.002 Bandwidth Hijacking detections · detection
• T1498 Network Denial of Service · simulation
• T1498 Network Denial of Service detections · detection
• T1499 Endpoint Denial of Service · simulation
• T1499 Endpoint Denial of Service detections · detection
• T1525 Implant Internal Image · simulation
• T1525 Implant Internal Image detections · detection
• T1528 Steal Application Access Token · simulation
• T1528 Steal Application Access Token detections · detection
• T1543 Create or Modify System Process · simulation
• T1543 Create or Modify System Process detections · detection
• T1543.005 Container Service · simulation
• T1543.005 Container Service detections · detection
• T1550 Use Alternate Authentication Material · simulation
• T1550 Use Alternate Authentication Material detections · detection
• T1550.001 Application Access Token · simulation
• T1550.001 Application Access Token detections · detection
• T1552 Unsecured Credentials · simulation
• T1552 Unsecured Credentials detections · detection
• T1552.001 Credentials In Files · simulation
• T1552.001 Credentials In Files detections · detection
• T1552.007 Container API · simulation
• T1552.007 Container API detections · detection
• T1609 Container Administration Command · simulation
• T1609 Container Administration Command detections · detection
• T1610 Deploy Container · simulation
• T1610 Deploy Container detections · detection
• T1611 Escape to Host · simulation
• T1611 Escape to Host detections · detection
• T1612 Build Image on Host · simulation
• T1612 Build Image on Host detections · detection
• T1613 Container and Resource Discovery · simulation
• T1613 Container and Resource Discovery detections · detection
• T1685 Disable or Modify Tools · simulation
• T1685 Disable or Modify Tools detections · detection
• User Account Authentication · telemetry
• User Account Creation · telemetry
• User Account Metadata · telemetry
• User Account Modification · telemetry
• Volume Deletion · telemetry
• Volume Modification · telemetry
• Web Credential Usage · telemetry
• Windows Registry Key Modification · telemetry