Adversaries may abuse built-in CLI tools or API calls to execute malicious commands in containerized environments. The Docker CLI is used for managing containers via an exposed API point from the `dockerd` daemon. Some common examples of Docker CLI include Docker Desktop CLI and Docker Compose,…
Sub-technique of Command and Scripting Interpreter (T1059).
T1059.013 Command and Scripting Interpreter: Container CLI/API
title: "T1059.013 Command and Scripting Interpreter: Container CLI/API"
id: 0a3daddc-5946-4f30-89f9-e694a00ac15b
description: 'Container CLI and API Abuse via Docker/Kubernetes (T1059.013). Detects execution of container management CLIs (docker, kubectl, nerdctl, crictl, podman) or curl-based calls directly against the Docker Unix socket API - the actual Container CLI/API abuse surface. (The previous version matched aws/az/gcloud/terraform/doctl, which are cloud-provider/IaC CLIs unrelated to this technique.) Tune using: AuthorizedUserAgents, NewImageThreshold, TimeWindow, InteractiveSessionExpectation.'
references:
- https://attack.mitre.org/techniques/T1059/013
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
- attack.execution
- attack.t1059.013
logsource:
category: process_creation
product: linux
service: auditd
detection:
selection_cli:
type: EXECVE
a0|endswith:
- '/docker'
- '/kubectl'
- '/nerdctl'
- '/crictl'
- '/podman'
selection_api:
type: EXECVE
a0|endswith: '/curl'
a1|contains:
- '/var/run/docker.sock'
- 'docker.sock'
condition: 1 of selection_*
falsepositives:
- Legitimate container orchestration, CI/CD pipelines, and ops tooling routinely invoke docker/kubectl; auditd only sees the local CLI invocation, not the actual API request body, so scope AuthorizedUserAgents/NewImageThreshold to known automation accounts and approved images.
level: low