{"id":"T1552.007","name":"Container API","url":"https://attack.mitre.org/techniques/T1552/007","tactics":["credential-access"],"platforms":["Containers"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0198","stix_id":"x-mitre-detection-strategy--8ca072de-1c09-4e19-acd2-e4228681030c","name":"Detect Abuse of Container APIs for Credential Access","url":"https://attack.mitre.org/detectionstrategies/DET0198","analytics":[{"id":"AN0571","stix_id":"x-mitre-analytic--2d054232-8968-4d11-b742-536b70bbb1ba","name":"Analytic 0571","description":"Detection correlates anomalous Docker or Kubernetes API requests with access to logs, secrets, or service accounts. Observes unauthorized use of `docker logs`, `kubectl get secrets`, or direct API calls to Kubernetes API server endpoints. Identifies behavioral patterns where adversaries escalate from basic pod/container interaction to privileged API calls exposing sensitive credential material.","url":"https://attack.mitre.org/detectionstrategies/DET0198#AN0571","platforms":["Containers"],"log_source_references":[{"name":"docker:api","channel":"docker logs access or container inspect commands from non-administrative users","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"docker-api"},{"name":"kubernetes:apiserver","channel":"get/list requests to /api/v1/secrets or /api/v1/namespaces/*/serviceaccounts","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"kubernetes-apiserver"},{"name":"kubernetes:apiserver","channel":"exec into pod followed by secret retrieval via API","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"kubernetes-apiserver"},{"name":"kubernetes:orchestrator","channel":"Access to orchestrator logs containing credentials (Docker/Kubernetes logs)","data_component":"DC0038","data_component_name":"Application Log Content","log_source_slug":"kubernetes-orchestrator"}],"mutable_elements":[{"field":"UserContext","description":"Tune to exclude known orchestrator admin service accounts or CI/CD pipelines that legitimately access secrets"},{"field":"NamespaceScope","description":"Restrict detection to sensitive namespaces (e.g., kube-system, production apps)"},{"field":"TimeWindow","description":"Adjust correlation timing between pod execution and subsequent API secret retrieval"},{"field":"SourceIP","description":"Filter based on allowed internal API calls vs anomalous external or cross-cluster access"}],"live":true,"detection_strategies":["DET0198"],"techniques":["T1552.007"]}],"live":true,"version":"1.0","techniques":["T1552.007"]}],"sigma_rules":[{"id":"6ad91e31-53df-4826-bd27-0166171c8040","title":"Google Cloud Kubernetes Admission Controller","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-11-25","modified":"2022-12-18","description":"Identifies when an admission controller is executed in GCP Kubernetes.\nA Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\nThe behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\nAn adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\nFor example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod. An adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\nAn adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\n","references":["https://cloud.google.com/kubernetes-engine/docs"],"logsource":{"product":"gcp","service":"gcp.audit"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.credential-access","attack.t1552","attack.t1552.007"],"path":"rules/cloud/gcp/audit/gcp_kubernetes_admission_controller.yml","techniques":["T1078","T1552","T1552.007"],"cves":[]},{"id":"a61a3c56-4ce2-4351-a079-88ae4cbd2b58","title":"Azure Kubernetes Admission Controller","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-11-25","modified":"2022-12-18","description":"Identifies when an admission controller is executed in Azure Kubernetes.\nA Kubernetes Admission controller intercepts, and possibly modifies, requests to the Kubernetes API server.\nThe behavior of this admission controller is determined by an admission webhook (MutatingAdmissionWebhook or ValidatingAdmissionWebhook) that the user deploys in the cluster.\nAn adversary can use such webhooks as the MutatingAdmissionWebhook for obtaining persistence in the cluster.\nFor example, attackers can intercept and modify the pod creation operations in the cluster and add their malicious container to every created pod.\nAn adversary can use the webhook ValidatingAdmissionWebhook, which could be used to obtain access credentials.\nAn adversary could use the webhook to intercept the requests to the API server, record secrets, and other sensitive information.\n","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.credential-access","attack.t1552","attack.t1552.007"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_admission_controller.yml","techniques":["T1078","T1552","T1552.007"],"cves":[]},{"id":"eeb3e9e1-b685-44e4-9232-6bb701f925b5","title":"Kubernetes Secrets Enumeration","author":"Leo Tsaousis (@laripping)","status":"test","level":"low","date":"2024-03-26","modified":null,"description":"Detects enumeration of Kubernetes secrets.","references":["https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/"],"logsource":{"product":"kubernetes","category":"application","service":"audit"},"tags":["attack.t1552.007","attack.credential-access"],"path":"rules/application/kubernetes/audit/kubernetes_audit_secrets_enumeration.yml","techniques":["T1552.007"],"cves":[]},{"id":"eed82177-38f5-4299-8a76-098d50d225ab","title":"Kubernetes Admission Controller Modification","author":"kelnage","status":"test","level":"medium","date":"2024-07-11","modified":null,"description":"Detects when a modification (create, update or replace) action is taken that affects mutating or validating webhook configurations, as they can be used by an adversary to achieve persistence or exfiltrate access credentials.\n","references":["https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/","https://security.padok.fr/en/blog/kubernetes-webhook-attackers"],"logsource":{"product":"kubernetes","service":"audit"},"tags":["attack.privilege-escalation","attack.initial-access","attack.persistence","attack.stealth","attack.t1078","attack.credential-access","attack.t1552","attack.t1552.007"],"path":"rules/application/kubernetes/audit/kubernetes_audit_change_admission_controller.yml","techniques":["T1078","T1552","T1552.007"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}