AN0693 Analytic 0693

Containers · attack.mitre.org · ATT&CK Enterprise v19.2

<p>Remote/API driven creation and start of a container whose image is not on an allow‑list (or is tagged latest), executed by a non-admin principal, and/or started with risky runtime attributes (e.g., --privileged, host PID/NET namespaces, sensitive host path mounts, capability adds). Correlates create ➜ start ➜ first network/process actions from that container within a short time window.</p>

Detects: T1610 Deploy Container
Part of: DET0249 Behavior-chain detection for T1610 Deploy Container across Docker & Kubernetes control/node planes

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
docker:daemon	`container_create,container_start`	DC0038 Application Log Content
containerd:runtime	`CRI CreateContainer/StartContainer with privileged=true OR added capabilities OR host* namespaces`	DC0077 Container Start
ebpf:syscalls	`process execution or network connect from just-created container PID namespace`	DC0032 Process Creation
docker:events	`remote API calls to /containers/create or /containers/{id}/start`	DC0085 Network Traffic Content

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`known_images`	Environment-specific allow-list of approved images (with digests).
`known_admins`	Service accounts or CI/CD users permitted to deploy containers.
`TimeWindow`	Max time between create, start, and first activity to consider events causally linked (default 5m).
`RiskThreshold`	Minimum number of risky attributes (e.g., unknown image + privileged) to alert.
`PrivilegedFlags`	Set of runtime flags considered high risk (e.g., --privileged, --cap-add=SYS_ADMIN, hostPID, hostNetwork, /var/run/docker.sock mount).