Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components. An adversary may access the Docker API to collect logs that contain…

T1552.007 Unsecured Credentials: Container API

title: "T1552.007 Unsecured Credentials: Container API"
id: c81d845b-9c68-4810-85b6-140eb650a93d
description: 'Detect Abuse of Container APIs for Credential Access. Removed the 169.254.169.254 selector, which detects cloud instance metadata access - the distinct T1552.005 Cloud Instance Metadata API technique, not Container API - and was conflating two different sub-techniques under one rule. This rule is now scoped strictly to docker.sock/Kubernetes API server access, the actual Container API behavior. (Data Component: Command Execution; baseline tier: fallback.) Tune using: UserContext, NamespaceScope, TimeWindow, SourceIP.'
references:
  - https://attack.mitre.org/techniques/T1552/007
author: Shahrukh Khan
date: 2026-05-12
license: MIT
tags:
  - attack.credential-access
  - attack.t1552.007

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_curl:
    type: EXECVE
    a0|endswith: '/curl'
    a1|contains:
      - '/var/run/docker.sock'
      - 'unix-socket'
  selection_kubectl_api:
    type: EXECVE
    a0|endswith:
      - '/kubectl'
      - '/curl'
    a1|contains:
      - 'kubernetes.default.svc'
      - '/api/v1/'

  condition: 1 of selection_*

falsepositives:
  - Monitoring agents and orchestration sidecars that legitimately query the docker unix socket or Kubernetes API server as part of normal operation.

level: medium

T1552.007 — Container API

Sigma detection rules (1)

T1552.007 Unsecured Credentials: Container API

Related sub-techniques

Explore