T1613 — Container and Resource Discovery

Tactic: Discovery · Platforms: Containers

Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster. These resources can be viewed within web applications such as…

Sigma detection rules (1)

T1613 Container and Resource Discovery

title: T1613 Container and Resource Discovery
id: 1ce6b89c-63fe-47c2-9b51-c36ae2ef29c8
description: 'Detection Strategy for Container and Resource Discovery. (Data Component: Pod Enumeration; baseline tier: fallback.) Tune using: UserAllowList, TimeWindow, PodQueryThreshold.'
references:
  - https://attack.mitre.org/techniques/T1613
author: Shahrukh Khan
date: 2026-05-18
license: MIT
tags:
  - attack.discovery
  - attack.t1613

logsource:
  product: kubernetes
  service: audit

detection:
  selection:
    verb:
      - 'list'
      - 'watch'
    objectRef.resource: 'pods'

  condition: selection

falsepositives:
  - Monitoring dashboards, autoscalers, and CI tooling that routinely enumerate pods across namespaces.

level: informational

Explore