ATT&CK for Containers

Project Summary

Published : May 3, 2021

This project investigated the viability of adding container-related techniques into MITRE ATT&CK, leading to the development of an ATT&CK for Containers matrix. This work covers both orchestration-level (e.g., Kubernetes) and container-level (e.g., Docker) adversary behaviors in a single Containers platform which has been incorporated in version 9 of ATT&CK. The project team worked with contributors from around the world to identify and refine both existing ATT&CK techniques as well as completely new container-specific ones.

The ATT&CK for Containers matrix contains:

21 techniques
11 sub-techniques
8 new container-specific techniques
3 new container-specific malware entries

Problem

Defenders lack visibility into adversary behaviors in and against container technologies leaving their organizations exposed to emerging threats.

SOLUTION

Expand MITRE ATT&CK to describe adversary behaviors in and against container technologies including Docker and Kubernetes.

IMPACT

Brings focus to adversary behaviors in an emergent domain leveraging the well-understood and widely adopted ATT&CK methodology.

Project Resources:

funding Research Participants

Share This Project

Explore More of Our Work

Silhouette of mountain climber at summit helping climber below climb a rope.

Center For Threat-Informed Defense Project

Summiting The Pyramid

September 13, 2023

two yellow cable cars at station

Center For Threat-Informed Defense Project

THREAT REPORT ATT&CK MAPPER (TRAM)

August 28, 2023

A group of people collaborating on an ATT&CK Workbench whiteboard.

Center For Threat-Informed Defense Project

ATT&CK Workbench

August 15, 2023

Stay Informed

Stay informed about new releases of R&D projects and other exciting updates from the Center for Threat-Informed Defense.