Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1609_container-administration-command
Adversaries may abuse a container administration service to execute commands within a container.
Passed 21 of 22 test cases with the skill, and 14 of 22 without it.
and 6 more in the full report
7 fixed14 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
In Atomic Red Team Test 2 for Docker container administration commands, what malware family is cited as an example of running shell scripts through container entry points, and what command tests this behavior?
| Checked | Without skill | With skill |
|---|---|---|
| References the Kinsing malware family. | Passed | Passed |
| Demonstrates running docker exec against a running container. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.
In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container. In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.
Platforms: Containers
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Attackers who have permissions, can run malicious commands in containers in the cluster using exec command (“kubectl exec”). In this method, attackers can use legitimate images, such as an OS image (e.g., Ubuntu) as a backdoor container, and run their malicious code remotely by using “kubectl exec”.
Supported Platforms: containers
kubectl create -f #{path} -n #{namespace}
# wait 3 seconds for the instance to come up
sleep 3
kubectl exec -n #{namespace} busybox -- #{command}
test cases passed, vs 14 / 22 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.