T1609 — Container Administration Command

Tactic: Execution · Platforms: Containers

Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment. In Docker, adversaries may…

Sigma detection rules (1)

T1609 Container Administration Command

title: T1609 Container Administration Command
id: ba1837c6-52cd-476c-ba23-466aa5b5663d
description: 'Detection Strategy for Container Administration Command Abuse. (Data Component: Command Execution; baseline tier: fallback.) Tune using: AuthorizedAdminUsers, ExecFrequencyThreshold, SourceIPRange, NamespaceScope.'
references:
  - https://attack.mitre.org/techniques/T1609
author: Shahrukh Khan
date: 2026-01-11
license: MIT
tags:
  - attack.execution
  - attack.t1609

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_docker:
    type: EXECVE
    a0|endswith: '/docker'
    a1: 'exec'
  selection_kubectl:
    type: EXECVE
    a0|endswith: '/kubectl'
    a1: 'exec'
  selection_privileged:
    type: EXECVE
    a0|endswith: '/docker'
    a1|contains: '--privileged'

  condition: 1 of selection_*

falsepositives:
  - Legitimate container administration and debugging by platform engineers and CI/CD pipelines running exec commands routinely.

level: high

Explore