Techniques › T1059.013 › AN0233
AN0233 Analytic 0233
Containers · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Execution of container orchestration commands (e.g.,
docker exec, kubectl exec) or API-driven interactions with running containers from unauthorized hosts or non-standard user contexts. Defender sees programmatic or interactive command execution within containers outside expected CI/CD tools or automation frameworks, often followed by file writes, privilege escalation, or lateral discovery.</p>- Detects
- T1059.013 Container CLI/API
- Part of
- DET0083 Container CLI and API Abuse via Docker/Kubernetes (T1059.013)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | execve: Execution of container management CLIs (docker, crictl, kubectl) or interpreted shells (sh, bash, python) within container context | DC0032 Process Creation |
| docker:events | exec_create: docker exec events targeting running containers from non-CI sources | DC0077 Container Start |
| kubernetes:apiserver | create/exec: Kubernetes API calls to exec into containers or create pods from curl, kubectl, or SDK clients | DC0072 Container Creation |
| AWS:CloudTrail | CreatePod: Programmatic creation of new pod resources using container images not seen before in the environment | DC0019 Pod Creation |
| kubernetes:audit | Shell process (e.g., /bin/sh, /bin/bash) spawned in a container without an interactive session attached (i.e., automation anomaly) | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AuthorizedUserAgents | List of CI/CD pipeline runners, SRE tools, or cluster mgmt agents allowed to invoke API/CLI commands in containers. |
NewImageThreshold | Threshold for alerting on unseen container images pulled and executed. Adjust to reduce noise from frequent deploys. |
TimeWindow | Temporal window to correlate container exec with shell spawn and network activity (default: 2 minutes). |
InteractiveSessionExpectation | Set whether shell spawns without TTY or PTY should be flagged — based on org deployment model. |