T1613
About this technique
Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.
Read the full ATT&CK description
These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.(Citation: Docker API)(Citation: Kubernetes API) In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing.
The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.
Curated incident relationships
These associations come from maintained incident records. The recorded confidence is shown when the source record provides it.
Daily items linked through predicted CVEs
A Daily item appears here when it mentions a CVE whose triage artifact predicts this technique. This is not a verified ATT&CK mapping.
Predicted CVE associations
These backfilled or model-produced candidates come from the current triage artifact. They are informational, not official MITRE mappings.