MITRE ATT&CKsub-technique

T1543.005 Container Service

Published 2024-02-15 Modified 2025-04-15 Official page ↗
Domain
enterprise
Tactics
Persistence, Privilege Escalation
Platforms
Containers
Version
1.0
Created
2024-02-15

Description

Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as kubelet. By modifying these services, an adversary may be able to achieve persistence or escalate their privileges on a host. For example, by using the `docker run` or `podman run` command with the `restart=always` directive, a container can be configured to persistently restart on the host. A user with access to the (rootful) docker command may also be able to escalate their privileges on the host. In Kubernetes environments, DaemonSets allow an adversary to persistently Deploy Containers on all nodes, including ones added later to the cluster. Pods can also be deployed to specific nodes using the `nodeSelector` or `nodeName` fields in the pod spec. Note that containers can also be configured to run as Systemd Services.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1543 Create or Modify System Process technique

Tactic · MITRE ATT&CK (2)

  • TA0003 Persistence tactic
  • TA0004 Privilege Escalation tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1054 Software Configuration mitigation
  • M1018 User Account Management mitigation

Referenced by MITRE ATT&CK · uses (1)

  • G1045 Salt Typhoon group

Referenced by Compliance · mitigates (8)

  • CIS-16.7 Use Standard Hardening Configuration Templates for Application Infrastructure CIS Safeguard v8.1
  • CIS-18.3 Remediate Penetration Test Findings CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control

References