T1613 Container and Resource Discovery
EnterpriseAdversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs. In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
platforms
Platforms this applies to.
tactics
ATT&CK tactics this technique serves.
mitigations
ATT&CK mitigations that reduce this.
detected by (2)
Data components that detect this.
NIST CSF 2.0 — areas of relevance (Protect / Detect)
NIST CSF 2.0 areas this most relates to (evidence-ranked).
- PR.AAIdentity Management, Authentication, and Access Controlstrong · backed by 5 of 10 mapped controls
- PR.DSData Securitystrong · backed by 5 of 10 mapped controls
- DE.CMContinuous Monitoringmoderate · backed by 4 of 10 mapped controls
Derived from MITRE CTID (Apache-2.0) and the NIST 800-53 ↔ CSF crosswalk (public domain). Indicative relevance along the Protect/Detect axis — not a compliance assessment or coverage claim.
mitigating controls (10)
Security controls that mitigate this.
groups (1)
Threat groups associated with this.
software (4)
Malware and tools associated with this.
Detected by (Sigma) (1)
Sigma detection rules related to this.
source
Where this definition is published.