Container Service
Subtechnique · ATTACK:enterprise:T1543.005
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1543.005",
"title": "Container Service",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1543/005",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--b0e54bf7-835e-4f44-bd8e-62f431b9b76a",
"external_id": "T1543.005",
"domain": "enterprise",
"created": "2024-02-15T13:41:46.784Z",
"modified": "2025-04-15T22:10:00.252Z",
"version": "1.0",
"aliases": [
],
"tactics": [
"persistence",
"privilege-escalation"
],
"source_references": [
{
"source_name": "AppSecco Kubernetes Namespace Breakout 2020",
"url": "https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216"
},
{
"source_name": "Docker Systemd",
"url": "https://docs.docker.com/config/containers/start-containers-automatically/"
},
{
"source_name": "GTFOBins Docker",
"url": "https://gtfobins.github.io/gtfobins/docker/"
},
{
"source_name": "Kubernetes Assigning Pods to Nodes",
"url": "https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/"
},
{
"source_name": "Kubernetes DaemonSet",
"url": "https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/"
},
{
"source_name": "Aquasec Kubernetes Attack 2023",
"url": "https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters"
},
{
"source_name": "AquaSec TeamTNT 2023",
"url": "https://blog.aquasec.com/teamtnt-reemerged-with-new-aggressive-cloud-campaign"
},
{
"source_name": "Podman Systemd",
"url": "https://www.redhat.com/sysadmin/podman-run-pods-systemd-services"
}
]
}Explicit source assertions (4)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1054 → mitigates → ATTACK:enterprise:T1543.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89210755-a9d6-4f6d-b485-1484a0d6db55
ATTACK:enterprise:T1543.005 → subtechnique-of → ATTACK:enterprise:T1543
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--89a3764f-0695-4121-9298-fe25d98dffe1
ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1543.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4170635-25df-4f04-8592-ef66cb929d83
CISA_AA25-239ASaltTyphoon_Sept2025ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1543.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c92e754c-48bf-4c8c-9504-47bd7f248baf