T1610 — Deploy Container

Tactic: Execution · Platforms: Containers

Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary…

Sigma detection rules (1)

T1610 Deploy Container

title: T1610 Deploy Container
id: ee713439-d298-4ca1-8779-be3b7b652108
description: 'Behavior-chain detection for T1610 Deploy Container across Docker & Kubernetes control/node planes. (Data Component: Application Log Content; baseline tier: fallback.) Tune using: known_images, known_admins, TimeWindow, RiskThreshold, PrivilegedFlags.'
references:
  - https://attack.mitre.org/techniques/T1610
author: Shahrukh Khan
date: 2026-05-09
license: MIT
tags:
  - attack.execution
  - attack.t1610

logsource:
  product: docker
  service: daemon

detection:
  selection:
    Type: 'container'
    Action:
      - 'create'
      - 'start'
  filter_known:
    Actor.Attributes.image|startswith: 'registry.trusted.corp/'

  condition: selection and not filter_known

falsepositives:
  - Legitimate deployment of new container images from a registry mirror that is not yet on the trusted allow list.

level: medium

Explore