Wiki › Techniques, Tactics & Procedures (TTPs) › Execution › Container Runtime Execution

Container Runtime Execution

3 min read

Jump to:

Overview

Container Runtime Execution refers to the technique where adversaries leverage container runtimes to execute malicious code within containerized environments. This technique plays a critical role in the Execution phase of the attack lifecycle by enabling attackers to run payloads in isolated or semi-isolated environments, often evading traditional detection mechanisms. Adversaries use container runtimes to blend malicious activity with legitimate container operations, complicating defense efforts.

Attack Objective

Execute arbitrary code to gain control or maintain presence within a target environment
Primarily supports the Execution stage, with potential impact on Persistence, Privilege Escalation, and Defense Evasion
Advances attacker position by leveraging container infrastructure to run malicious processes with varying levels of isolation and privilege

How the Technique Works

Adversaries exploit container runtimes—software responsible for running and managing containers—to launch malicious code inside containers or container-like environments. This may involve creating new containers with attacker-controlled images, injecting code into existing containers, or manipulating runtime configurations to execute commands. The technique leverages the abstraction and isolation features of containers to execute payloads while potentially bypassing host-level security controls.

Common Methods & Variations

Launching malicious containers using compromised or attacker-supplied container images
Executing commands inside running containers via runtime interfaces or APIs
Abusing container orchestration platforms (e.g., Kubernetes) to schedule and run malicious workloads
On-premises and cloud environments where container platforms are deployed
Use of legitimate container runtime tools (e.g., Docker, containerd, CRI-O) as living-off-the-land binaries versus deploying custom or malicious container runtimes

Indicators of Compromise (IOCs)

Unusual container creation or execution events in container runtime logs
Execution of unexpected commands or processes within containers
Network connections originating from containers to suspicious endpoints
Changes to container images or runtime configurations without authorized action
Cloud audit logs showing anomalous container orchestration activities

Detection Strategies

Monitoring container runtime logs and orchestration platform audit logs for anomalous container lifecycle events
Behavioral detection focusing on unusual process execution patterns within containers
Correlation of container activity with network telemetry to identify suspicious communications
Use of runtime security tools to detect deviations from expected container behavior

Mitigation & Prevention

Implement strict access controls and authentication for container runtimes and orchestration platforms
Enforce image signing and verification to prevent unauthorized container images
Apply least privilege principles to container permissions and runtime capabilities
Regularly update container runtimes and orchestration software to patch vulnerabilities
Use network segmentation and micro-segmentation to limit container communication

Response Considerations

Isolate affected containers and nodes to contain malicious execution
Analyze container logs and orchestration events to determine scope and timeline of compromise
Remove or rebuild compromised containers with verified images
Review and harden container runtime configurations and access controls post-incident

Related Techniques

Execution through Scheduled Tasks or Jobs (e.g., cron jobs in containers)
Privilege Escalation via Container Escape
Defense Evasion through Obfuscated Files or Information within containers
Lateral Movement using container orchestration APIs

Mapping & References

MITRE ATT&CK: Execution – T1202 (User Execution), T1059 (Command and Scripting Interpreter), T1611 (Container Administration Command)
MITRE ATT&CK: Persistence – T1543.003 (Create or Modify System Process: Windows Service)
Public research on container security threats and runtime exploitation (e.g., reports by security vendors and cloud providers)

Tags: Adversary Techniques Cloud Security Container Orchestration Container Security endpoint security Execution Incident Response MITRE ATT&CK Runtime Exploitation Threat Detection