T1543.005 — Container Service

Tactics: Persistence, Privilege Escalation · Platforms: Containers

Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts. These include software for creating and managing individual containers, such as Docker and Podman, as well as container cluster node-level agents such as…

Sub-technique of Create or Modify System Process (T1543).

Sigma detection rules (1)

T1543.005 Create or Modify System Process: Container Service

title: "T1543.005 Create or Modify System Process: Container Service"
id: a3faaacf-3ffe-490d-8e15-a465f1429fb9
description: 'Detect persistent or elevated container services via container runtime or cluster manipulation. Fixed: added the docker/podman `run --restart=always` selection called out as the primary Linux-relevant example in the technique description; the previous `kubectl apply -f <manifest>` + a2 contains "DaemonSet" selection could never actually see "DaemonSet" since manifest content lives inside the referenced file, not in argv, and that selection was OR-ed independently of the kubectl selection so it could match unrelated EXECVE events. Replaced the manifest-content check with `kubectl create daemonset`, whose resource-type argument ("daemonset") is genuinely visible in argv. Tune using: restartPolicy, targetNamespace, nodeSelector|nodeName, unitFilePath, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1543/005
author: Shahrukh Khan
date: 2026-02-27
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1543.005

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_container_restart_always:
    - type: EXECVE
      a0|endswith: ['/docker', '/podman']
      a1: 'run'
      a2|contains: '--restart=always'
    - type: EXECVE
      a0|endswith: ['/docker', '/podman']
      a1: 'run'
      a3|contains: '--restart=always'
    - type: EXECVE
      a0|endswith: ['/docker', '/podman']
      a1: 'run'
      a4|contains: '--restart=always'
  selection_kubectl_create_daemonset:
    type: EXECVE
    a0|endswith: '/kubectl'
    a1: 'create'
    a2: 'daemonset'

  condition: selection_container_restart_always or selection_kubectl_create_daemonset

falsepositives:
  - Legitimate persistent service containers (log shippers, monitoring agents, reverse proxies) are commonly run with --restart=always by admins; legitimate cluster-wide agent rollout also uses `kubectl create daemonset` or DaemonSet manifests via `apply -f` (the latter intentionally not inspected here since manifest content isn't visible in argv) — restartPolicy/nodeSelector tuning should focus on unusual privileged/hostPID containers rather than the flag alone.

level: high

Related sub-techniques

Explore