Wiki › Techniques, Tactics & Procedures (TTPs) › Lateral Movement › Container-to-Container Lateral Movement

Container-to-Container Lateral Movement

3 min read

Jump to:

Overview

Container-to-container lateral movement is a technique used by adversaries to move laterally within a containerized environment by exploiting communication channels or vulnerabilities between containers. This technique enables attackers to expand their foothold beyond an initially compromised container, facilitating further access and control within the target infrastructure. It plays a critical role in the lateral movement phase of the attack lifecycle, allowing adversaries to escalate privileges and access sensitive resources.

Attack Objective

Gain expanded access and control across multiple containers within a containerized environment
Supports the Lateral Movement stage of the attack lifecycle
Advances the attacker’s position by enabling compromise of additional containers, potentially leading to host or cluster-wide control

How the Technique Works

Adversaries leverage inter-container communication mechanisms, shared resources, or misconfigurations to move from one compromised container to others. This may involve exploiting exposed container APIs, shared volumes, network connections, or weak access controls that allow execution of commands or code in adjacent containers. By doing so, attackers can propagate their presence, escalate privileges, and access sensitive data or services hosted in other containers within the same environment.

Common Methods & Variations

Exploitation of container orchestration APIs or misconfigured service meshes to access other containers
Abuse of shared storage volumes or file systems mounted across containers
Use of network protocols and open ports allowing container-to-container communication
On-premises and cloud container platforms, including Kubernetes and Docker Swarm environments
Living-off-the-land approaches leveraging native container tools and commands versus custom malware or scripts

Indicators of Compromise (IOCs)

Unusual inter-container network traffic or connections between containers not typically communicating
Unexpected API calls or access patterns to container orchestration services
Execution of commands or processes within containers inconsistent with normal operations
Access to shared volumes or files by containers that do not normally require them
Authentication or authorization failures related to container service accounts or identities

Detection Strategies

Monitoring container network traffic and inter-container communication logs
Behavioral analysis to identify anomalous container activity or process execution
Correlation of orchestration API access logs with container runtime events
Use of endpoint detection within containers to detect suspicious commands or privilege escalations
Integration of cloud-native security telemetry where applicable

Mitigation & Prevention

Implement strict network segmentation and micro-segmentation between containers
Enforce least privilege access for container identities and service accounts
Harden container orchestration platform configurations and restrict API access
Limit or eliminate shared volumes unless explicitly required and secured
Regularly update and patch container images and orchestration components

Response Considerations

Isolate compromised containers to prevent further lateral movement
Conduct detailed forensic analysis of container logs, network traffic, and orchestration events
Identify and remediate misconfigurations or vulnerabilities exploited during the attack
Rebuild or redeploy affected containers with hardened configurations
Review and update access controls and monitoring policies to prevent recurrence

Related Techniques

Initial Access via container vulnerabilities or compromised images
Privilege Escalation within containers or host systems
Command and Control through container orchestration APIs
Persistence by modifying container or orchestration configurations

Mapping & References

MITRE ATT&CK: T1574.002 (Hijack Execution Flow: Container Execution Hijacking)
MITRE ATT&CK: T1564 (Hide Artifacts) – relevant for evasion within containers
Cloud Native Computing Foundation (CNCF) security best practices
Public advisories on container security and lateral movement techniques from security vendors and research groups

Tags: Attack Lifecycle Cloud Security Container Orchestration Container Security Docker Kubernetes lateral movement network segmentation privilege escalation Threat Detection