T1552.007

Official Description

Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API)

An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.

Tactics: Credential Access
Platforms: Containers
Parent Technique: T1552 · Unsecured Credentials
MITRE Version: 1.2
Last Modified: Oct 24, 2025

View on MITRE ATT&CK ↗

Reported Context (1)

The local collector connects to the Docker daemon socket to retrieve environment variables from running containers, falling back to the Docker CLI. TeamPCP Python Toolkit Uses FIRESCALE and Victim GitHub Accounts to Survive C2 Disruption

Malware (1)

Threat Actors (1)

MITRE ATT&CK (17)

Vendors (2)

Products (33)

Tools (1)

Industries (2)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.