Skip to content

Container Administration Command

Technique · ATTACK:enterprise:T1609

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1609",
  "title": "Container Administration Command",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1609",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--7b50a1d3-4ca7-45d1-989d-a6503f04bfe1",
  "external_id": "T1609",
  "domain": "enterprise",
  "created": "2021-03-29T16:39:26.183Z",
  "modified": "2025-10-24T17:48:59.945Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "Docker Exec",
      "url": "https://docs.docker.com/engine/reference/commandline/exec/"
    },
    {
      "source_name": "Docker Entrypoint",
      "url": "https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime"
    },
    {
      "source_name": "Docker Daemon CLI",
      "url": "https://docs.docker.com/engine/reference/commandline/dockerd/"
    },
    {
      "source_name": "Kubectl Exec Get Shell",
      "url": "https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/"
    },
    {
      "source_name": "Kubernetes Kubelet",
      "url": "https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/"
    },
    {
      "source_name": "Kubernetes API",
      "url": "https://kubernetes.io/docs/concepts/overview/kubernetes-api/"
    }
  ]
}

Explicit source assertions (14)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--12ea5ead-f19a-488e-8b47-ceb9d45593fd

Unit 42 Hildegard Malware

ATTACK:enterprise:S0683 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--17530a5c-d0a2-4a4d-8617-d0659b443e3a

Peirates GitHub

ATTACK:enterprise:S0601 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4428158e-cf07-49f0-8a9f-5cc767027e2a

Unit 42 Hildegard Malware

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d98988c-bac6-48da-9bc8-6e4375317fd4

Kubernetes RBAC · Kubernetes Hardening Guide

ATTACK:enterprise:S9042 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7529023c-bf57-4cdc-9ccb-d6e56d29e081

Aikido CanisterWorm MAR 2026 · Palo Alto TeamPCP MAR 2026

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9dcf3707-34ff-4a44-b65b-fc1f8f127bf5

Kubernetes Admission Controllers · Kubernetes Hardening Guide

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3a13b78-f599-4635-8750-2603bf18b370

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aad3b74f-bc6a-4662-9388-e44958c7ba10

Aqua Security Blog Trivy Compromise APR 2026

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af573ba3-42c6-497b-8d1c-063a159a4eee

Trend Micro TeamPCP MAY 2026 · Phoenix TeamPCP 20 MAY 2026

ATTACK:enterprise:S0623 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bcee03c4-6420-4280-8212-c8aa44a13730

Unit 42 Siloscape Jun 2021

ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0dedd7e-d480-4611-b4b2-90f1ba71091b

Aqua Kinsing April 2020

ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d8b7535e-7cf7-408e-acd3-a42fc77a5e35

Docker Daemon Socket Protect · Kubernetes Cloud Native Security · Microsoft AKS Azure AD 2023 · Kubernetes API Control Access

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f77c32a3-f696-4dd0-a66b-dc9b765ade46

AI-Mexico-Govt-Compromise

ATTACK:enterprise:M1038 → mitigates → ATTACK:enterprise:T1609

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fd9cf3cc-51cd-4f13-b90e-2b8e274a4cc1

Kubernetes Security Context · Kubernetes Hardening Guide

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.