THREATNOIR
Subscribe
MITRE ATT&CK · T1610

Deploy Container

MITRE · cited in 5 of our lessons

Explanation

What attackers do. Attackers deploy a container into an environment to run their tools or evade defences, for example a container with a malicious image or with broad access to the host. This serves Defence Evasion and Execution.

How to defend. Restrict who can deploy containers, require images from trusted registries, scan images, and use admission control policies that block privileged containers and host mounts. Protect container runtime APIs and orchestration dashboards from unauthenticated access. Collect audit logs from orchestration platforms and container runtimes so deployments can be traced to an identity. Runtime security tools can watch container behaviour after it starts.

Signs to look for. Look for containers from unknown images or registries, new deployments by unusual accounts, containers with privileged settings and access to exposed container APIs from the internet. A common gap is exposed container management interfaces without authentication.

Open the technique on MITRE ATT&CK
The official text
Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to Escape to Host and access other containers running on the node. Containers can be deployed by various means, such as via Docker's `create` and `start` APIs or via a web application such as the Kubernetes dashboard or Kubeflow. In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes. Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.