T1613 Container and Resource Discovery

T1613 Container and Resource Discovery

High-Level Description

Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.

These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs. In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing. The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.

Kill Chain Phase

• Discovery (TA0007)

Platforms: Containers

What to Check

• Identify if Container and Resource Discovery technique is applicable to target environment
• Check Containers systems for indicators of Container and Resource Discovery
• Verify mitigations are bypassed or absent (3 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Docker Container and Resource Discovery

Adversaries may attempt to discover containers and other resources that are available within a containers environment.

Supported Platforms: containers

docker build -t t1613 $PathtoAtomicsFolder/T1613/src/
docker run --name t1613_container --rm -d -t t1613
docker ps
docker stats --no-stream
docker inspect $(docker ps -l -q --filter ancestor=t1613)