Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1059.013_container-cliapi
Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments.
Passed 22 of 25 test cases with the skill, and 15 of 25 without it.
and 8 more in the full report
7 fixed16 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 6 test cases the skill fixed. Same model, same prompt, with and without the skill.
During our application security review, we need to map container CLI and API execution techniques (T1059.013) to Common Weakness Enumeration (CWE) categories for reporting. Which CWE ID is specifically associated with this technique?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies CWE-94 (Improper Control of Generation of Code). | Missed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1059
Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments.
The Docker CLI is used for managing containers via an exposed API point from the dockerd daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose, but users are also able to use SDKs to interact with the API. For example, Docker SDK for Python can be used to run commands within a Python application.
Adversaries may leverage the Docker CLI, API, or SDK to pull or build Docker images (i.e., Ingress Tool Transfer, Build Image on Host), run containers (i.e., Deploy Container), or execute commands inside running containers (i.e., Container Administration Command). In some cases, threat actors may pull legitimate images that include scripts or tools that they can leverage - for example, using an image that includes the curl command to download payloads. Adversaries may also utilize docker inspect and docker ps to scan for cloud environment variables and other running containers (i.e., Container and Resource Discovery).
Kubernetes is responsible for the management and orchestration of containers across clusters. The Kubernetes control plane, which manages the state of the cluster and is responsible for scheduling, communication, and resource monitoring, can be invoked directly via the API or indirectly via CLI tools such as kubectl. It may also be accessed within client libraries such as Go or Python. By utilizing the API, administrators can interact with resources within the cluster such as listing or creating pods, which is a group of one or more containers. Adversaries call the API server via curl or other tools, allowing them to obtain further information about the environment such as pods, deployments, daemonsets, namespaces, or sysvars. They may also run various commands regarding resource management.
Platforms: Containers
Identify Attack Surface: Determine if the target environment is susceptible to Container CLI/API by examining the target platforms (Containers).
Assess Existing Defenses: Review whether mitigations for T1059.013 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Note: No Atomic Red Team tests available for this technique. See Atomic Red Team GitHub for updates.
test cases passed, vs 15 / 25 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.