Techniques › T1613 › AN1352
AN1352 Analytic 1352
Containers · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detection of adversary attempts to enumerate containers, pods, nodes, and related resources within containerized environments. Defenders may observe anomalous API calls to Docker or Kubernetes (e.g., 'docker ps', 'kubectl get pods', 'kubectl get nodes'), unusual account activity against the Kubernetes dashboard, or unexpected queries against container metadata endpoints. These events should be correlated with user context and network activity to reveal resource discovery attempts.</p>
- Detects
- T1613 Container and Resource Discovery
- Part of
- DET0490 Detection Strategy for Container and Resource Discovery
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| kubernetes:apiserver | list or get requests against pods, deployments, or nodes | DC0037 Pod Enumeration |
| docker:daemon | docker ps, docker inspect, or docker images commands | DC0091 Container Enumeration |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UserAllowList | Defines which service accounts and admin roles are expected to perform discovery actions. Activity by non-allowlisted identities may indicate adversary discovery. |
TimeWindow | Specifies correlation period (e.g., 10m) for linking multiple discovery attempts across API and daemon logs. |
PodQueryThreshold | Defines threshold for number of pod/node enumeration requests by a single user. Excessive queries may indicate scanning activity. |