Techniques › T1552.007 › AN0571
AN0571 Analytic 0571
Containers · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection correlates anomalous Docker or Kubernetes API requests with access to logs, secrets, or service accounts. Observes unauthorized use of
docker logs, kubectl get secrets, or direct API calls to Kubernetes API server endpoints. Identifies behavioral patterns where adversaries escalate from basic pod/container interaction to privileged API calls exposing sensitive credential material.</p>- Detects
- T1552.007 Container API
- Part of
- DET0198 Detect Abuse of Container APIs for Credential Access
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| docker:api | docker logs access or container inspect commands from non-administrative users | DC0064 Command Execution |
| kubernetes:apiserver | get/list requests to /api/v1/secrets or /api/v1/namespaces/*/serviceaccounts | DC0002 User Account Authentication |
| kubernetes:apiserver | exec into pod followed by secret retrieval via API | DC0032 Process Creation |
| kubernetes:orchestrator | Access to orchestrator logs containing credentials (Docker/Kubernetes logs) | DC0038 Application Log Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UserContext | Tune to exclude known orchestrator admin service accounts or CI/CD pipelines that legitimately access secrets |
NamespaceScope | Restrict detection to sensitive namespaces (e.g., kube-system, production apps) |
TimeWindow | Adjust correlation timing between pod execution and subsequent API secret retrieval |
SourceIP | Filter based on allowed internal API calls vs anomalous external or cross-cluster access |