1. Home
  2. Matrices
  3. Enterprise
  4. Containers

Containers Matrix

Below are the tactics and techniques representing the MITRE ATT&CK® Containers platform. The techniques below are known to target containers and container orchestration systems such as Kubernetes. The Matrix contains information for the Containers platform.

View on the ATT&CK® Navigator
Version Permalink
Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Impact
3 techniques 5 techniques 7 techniques 6 techniques 4 techniques 1 techniques 3 techniques 3 techniques 1 techniques 5 techniques
Exploit Public-Facing Application
External Remote Services
Valid Accounts (2)
=
Command and Scripting Interpreter (1)
=
Container Administration Command
Deploy Container
Scheduled Task/Job (1)
=
User Execution (1)
=
Account Manipulation (1)
=
Create Account (1)
=
Create or Modify System Process (1)
=
External Remote Services
Implant Internal Image
Scheduled Task/Job (1)
=
Valid Accounts (2)
=
Account Manipulation (1)
=
Create or Modify System Process (1)
=
Escape to Host
Exploitation for Privilege Escalation
Scheduled Task/Job (1)
=
Valid Accounts (2)
=
Build Image on Host
Indicator Removal
Masquerading (2)
=
Valid Accounts (2)
=
Disable or Modify Tools
Brute Force (3)
=
Steal Application Access Token
Unsecured Credentials (2)
=
Container and Resource Discovery
Network Service Discovery
Permission Groups Discovery
Use Alternate Authentication Material (1)
=
Data Destruction
Endpoint Denial of Service
Inhibit System Recovery
Network Denial of Service
Resource Hijacking (2)
=
Initial Access Execution Persistence Privilege Escalation Stealth Defense Impairment Credential Access Discovery Lateral Movement Impact
3 techniques 5 techniques 7 techniques 6 techniques 4 techniques 1 techniques 3 techniques 3 techniques 1 techniques 5 techniques
Exploit Public-Facing Application
External Remote Services
=
Valid Accounts (2)
=
Command and Scripting Interpreter (1)
Container Administration Command
Deploy Container
=
Scheduled Task/Job (1)
=
User Execution (1)
=
Account Manipulation (1)
=
Create Account (1)
=
Create or Modify System Process (1)
External Remote Services
Implant Internal Image
=
Scheduled Task/Job (1)
=
Valid Accounts (2)
=
Account Manipulation (1)
=
Create or Modify System Process (1)
Escape to Host
Exploitation for Privilege Escalation
=
Scheduled Task/Job (1)
=
Valid Accounts (2)
Build Image on Host
Indicator Removal
=
Masquerading (2)
=
Valid Accounts (2)
Disable or Modify Tools
=
Brute Force (3)
Steal Application Access Token
=
Unsecured Credentials (2)
Container and Resource Discovery
Network Service Discovery
Permission Groups Discovery
=
Use Alternate Authentication Material (1)
Data Destruction
Endpoint Denial of Service
Inhibit System Recovery
Network Denial of Service
=
Resource Hijacking (2)