Containers Atomic Tests by ATT&CK Tactic & Technique

discovery

• T1613 Container and Resource Discovery
  • Atomic Test #1: Docker Container and Resource Discovery [containers]
  • Atomic Test #2: Podman Container and Resource Discovery [containers]
• T1069 Permission Groups Discovery CONTRIBUTE A TEST
• T1046 Network Service Discovery
  • Atomic Test #9: Network Service Discovery for Containers [containers]

credential-access

• T1110.001 Brute Force: Password Guessing CONTRIBUTE A TEST
• T1552 Unsecured Credentials CONTRIBUTE A TEST
• T1110.003 Brute Force: Password Spraying CONTRIBUTE A TEST
• T1552.001 Unsecured Credentials: Credentials In Files CONTRIBUTE A TEST
• T1528 Steal Application Access Token CONTRIBUTE A TEST
• T1110 Brute Force CONTRIBUTE A TEST
• T1110.004 Brute Force: Credential Stuffing CONTRIBUTE A TEST
• T1552.007 Kubernetes List Secrets
  • Atomic Test #1: List All Secrets [containers]
  • Atomic Test #2: ListSecrets [containers]

persistence

• T1543 Create or Modify System Process CONTRIBUTE A TEST
• T1133 External Remote Services CONTRIBUTE A TEST
• T1053.007 Kubernetes Cronjob
  • Atomic Test #1: ListCronjobs [containers]
  • Atomic Test #2: CreateCronjob [containers]
• T1098.006 Additional Container Cluster Roles CONTRIBUTE A TEST
• T1053 Scheduled Task/Job CONTRIBUTE A TEST
• T1525 Implant Internal Image CONTRIBUTE A TEST
• T1078.001 Valid Accounts: Default Accounts CONTRIBUTE A TEST
• T1136.001 Create Account: Local Account CONTRIBUTE A TEST
• T1098 Account Manipulation CONTRIBUTE A TEST
• T1543.005 Container Service CONTRIBUTE A TEST
• T1078 Valid Accounts CONTRIBUTE A TEST
• T1136 Create Account CONTRIBUTE A TEST
• T1078.003 Valid Accounts: Local Accounts CONTRIBUTE A TEST

privilege-escalation

• T1543 Create or Modify System Process CONTRIBUTE A TEST
• T1053.007 Kubernetes Cronjob
  • Atomic Test #1: ListCronjobs [containers]
  • Atomic Test #2: CreateCronjob [containers]
• T1098.006 Additional Container Cluster Roles CONTRIBUTE A TEST
• T1053 Scheduled Task/Job CONTRIBUTE A TEST
• T1611 Escape to Host
  • Atomic Test #1: Deploy container using nsenter container escape [containers]
  • Atomic Test #2: Mount host filesystem to escape privileged Docker container [containers]
• T1078.001 Valid Accounts: Default Accounts CONTRIBUTE A TEST
• T1098 Account Manipulation CONTRIBUTE A TEST
• T1543.005 Container Service CONTRIBUTE A TEST
• T1078 Valid Accounts CONTRIBUTE A TEST
• T1068 Exploitation for Privilege Escalation CONTRIBUTE A TEST
• T1078.003 Valid Accounts: Local Accounts CONTRIBUTE A TEST

initial-access

• T1133 External Remote Services CONTRIBUTE A TEST
• T1190 Exploit Public-Facing Application CONTRIBUTE A TEST
• T1078.001 Valid Accounts: Default Accounts CONTRIBUTE A TEST
• T1078 Valid Accounts CONTRIBUTE A TEST
• T1078.003 Valid Accounts: Local Accounts CONTRIBUTE A TEST

execution

• T1053.007 Kubernetes Cronjob
  • Atomic Test #1: ListCronjobs [containers]
  • Atomic Test #2: CreateCronjob [containers]
• T1053 Scheduled Task/Job CONTRIBUTE A TEST
• T1610 Deploy a container
  • Atomic Test #1: Deploy Docker container [containers]
• T1609 Kubernetes Exec Into Container
  • Atomic Test #1: ExecIntoContainer [containers]
  • Atomic Test #2: Docker Exec Into Container [containers]
• T1204 User Execution CONTRIBUTE A TEST
• T1204.003 User Execution: Malicious Image CONTRIBUTE A TEST

defense-evasion

• T1036.005 Masquerading: Match Legitimate Name or Location CONTRIBUTE A TEST
• T1562 Impair Defenses CONTRIBUTE A TEST
• T1036 Masquerading CONTRIBUTE A TEST
• T1550 Use Alternate Authentication Material CONTRIBUTE A TEST
• T1610 Deploy a container
  • Atomic Test #1: Deploy Docker container [containers]
• T1078.001 Valid Accounts: Default Accounts CONTRIBUTE A TEST
• T1070 Indicator Removal on Host CONTRIBUTE A TEST
• T1612 Build Image on Host
  • Atomic Test #1: Build Image On Host [containers]
• T1562.001 Impair Defenses: Disable or Modify Tools CONTRIBUTE A TEST
• T1078 Valid Accounts CONTRIBUTE A TEST
• T1550.001 Application Access Token CONTRIBUTE A TEST
• T1078.003 Valid Accounts: Local Accounts CONTRIBUTE A TEST

lateral-movement

• T1550 Use Alternate Authentication Material CONTRIBUTE A TEST
• T1550.001 Application Access Token CONTRIBUTE A TEST

impact

• T1499 Endpoint Denial of Service CONTRIBUTE A TEST
• T1496 Resource Hijacking CONTRIBUTE A TEST
• T1485 Data Destruction CONTRIBUTE A TEST
• T1498 Network Denial of Service CONTRIBUTE A TEST
• T1490 Inhibit System Recovery CONTRIBUTE A TEST