EXPLORE
← Back to Explore
T1613

Container and Resource Discovery

Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the en...

Containers
30
Detections
1
Sources
1
Threat Actors

BY SOURCE

30elastic

PROCEDURES (18)

Token4 detections

Auto-extracted: 4 detections for token

Service3 detections

Auto-extracted: 3 detections for service

Credential2 detections

Auto-extracted: 2 detections for credential

Api2 detections

Auto-extracted: 2 detections for api

Privilege2 detections

Auto-extracted: 2 detections for privilege

Lateral2 detections

Auto-extracted: 2 detections for lateral

Container2 detections

Auto-extracted: 2 detections for container

Service2 detections

Auto-extracted: 2 detections for service

Api2 detections

Auto-extracted: 2 detections for api

Unusual1 detections

Auto-extracted: 1 detections for unusual

Token1 detections

Auto-extracted: 1 detections for token

Unusual1 detections

Auto-extracted: 1 detections for unusual

Privilege1 detections

Auto-extracted: 1 detections for privilege

Lateral1 detections

Auto-extracted: 1 detections for lateral

Credential1 detections

Auto-extracted: 1 detections for credential

Kubernetes1 detections

Auto-extracted: 1 detections for kubernetes

Unusual1 detections

Auto-extracted: 1 detections for unusual

Privilege1 detections

Auto-extracted: 1 detections for privilege

THREAT ACTORS (1)

DETECTIONS (30)

Container Management Utility Execution Detected via Defend for Containers
elasticlow
Container Management Utility Run Inside A Container
elasticlow
Direct Interactive Kubernetes API Request by Common Utilities
elasticmedium
Direct Interactive Kubernetes API Request by Unusual Utilities
elasticlow
Direct Interactive Kubernetes API Request Detected via Defend for Containers
elasticlow
DNS Enumeration Detected via Defend for Containers
elasticlow
Docker Socket Enumeration
elasticmedium
Environment Variable Enumeration Detected via Defend for Containers
elasticlow
Forbidden Direct Interactive Kubernetes API Request
elasticmedium
GitHub Authentication Token Access via Node.js
elasticmedium
Interactive Privilege Boundary Enumeration Detected via Defend for Containers
elasticlow
Kubeconfig File Discovery
elasticlow
Kubectl Permission Discovery
elasticmedium
Kubectl Secrets Enumeration Across All Namespaces
elasticmedium
Kubelet Certificate File Access Detected via Defend for Containers
elasticlow
Kubelet Pod Discovery Detected via Defend for Containers
elasticlow
Kubernetes Denied Service Account Request via Unusual User Agent
elasticlow
Kubernetes Direct API Request via Curl or Wget
elasticmedium
Kubernetes Forbidden Request from Unusual User Agent
elasticmedium
Kubernetes Potential Endpoint Permission Enumeration Attempt by Anonymous User Detected
elasticmedium
Kubernetes Potential Endpoint Permission Enumeration Attempt Detected
elasticmedium
Kubernetes Service Account Secret Access
elasticmedium
Kubernetes Suspicious Self-Subject Review via Unusual User Agent
elasticlow
Potential Cluster Enumeration via jq Detected via Defend for Containers
elasticlow
Potential Direct Kubelet Access via Process Arguments Detected via Defend for Containers
elasticmedium
Potential Kubectl Masquerading via Unexpected Process
elasticmedium
Potential Kubeletctl Execution Detected via Defend for Containers
elasticlow
Service Account Namespace Read Detected via Defend for Containers
elasticlow
Service Account Token or Certificate Access Followed by Kubernetes API Request
elasticmedium
Tool Enumeration Detected via Defend for Containers
elasticlow