Container Administration Command
Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet) In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <c...
BY SOURCE
PROCEDURES (27)
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for container
Auto-extracted: 2 detections for privilege
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for token
Auto-extracted: 2 detections for unusual
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for http
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for service monitoring
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for container
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for email security
Auto-extracted: 1 detections for cloud
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for unusual