Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1610_deploy-container
Adversaries may deploy a container into an environment to facilitate execution or evade defenses.
Passed 22 of 23 test cases with the skill, and 19 of 23 without it.
3 fixed19 passed either way1 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
A security engineer is writing a bash script to simulate adversary container deployment using Docker based on Atomic Red Team patterns. They need to build an image tagged `t1610` from a local Atomics source folder and run a detached container named `t1610_container` that executes `/tmp/script.sh`. What exact Docker build and run invocation patterns should be used?
| Checked | Without skill | With skill |
|---|---|---|
| Uses docker build with -t t1610 | Passed | Passed |
| Uses docker run with --name t1610_container and -itd | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to Escape to Host and access other containers running on the node.
Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow. In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes. Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.
Platforms: Containers
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime. They can do this using docker create and docker start commands. Kinsing & Doki was exploited using this technique.
Supported Platforms: containers
docker build -t t1610 $PathtoAtomicsFolder/T1610/src/
docker run --name t1610_container --rm -itd t1610 bash /tmp/script.sh
Dependencies:
test cases passed, vs 19 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.