MITRE ATT&CK Technique
T1609Container Administration Command
- First Reported
- Jul 17, 2024
- Latest Reported
- Feb 11, 2025
Official Description
Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)
In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <code>docker exec</code> to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as <code>kubectl exec</code>.(Citation: Kubectl Exec Get Shell)
In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <code>docker exec</code> to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as <code>kubectl exec</code>.(Citation: Kubectl Exec Get Shell)
- Tactics
- Execution
- Platforms
- Containers
- MITRE Version
- 1.3
- Last Modified
- Oct 24, 2025
Reported Context (2)
- After accessing the host's docker.sock, the exploit launches a privileged container to gain full host access. Wiz Details NVIDIA Container Toolkit Flaw Enabling Host Escape
- The researchers used the Helm Tiller server's install operation to deploy the privileged Pod to the Kubernetes cluster. Wiz Researchers Detail SAP AI Core Vulnerability Chain That Exposed Customer Secrets
CVE (2)
People (6)
MITRE ATT&CK (4)
Vendors (3)
Products (12)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.