| ID | Name |
|---|---|
| T1552.001 | Credentials In Files |
| T1552.002 | Credentials in Registry |
| T1552.003 | Bash History |
| T1552.004 | Private Keys |
| T1552.005 | Cloud Instance Metadata API |
| T1552.006 | Group Policy Preferences |
| T1552.007 | Container API |
Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.[1][2]
An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.[3] An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.
| ID | Mitigation | Description |
|---|---|---|
| M1035 | Limit Access to Resource Over Network |
Limit communications with the container service to local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API and Kubernetes API Server.[4][5] |
| M1030 | Network Segmentation |
Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. |
| M1026 | Privileged Account Management |
Use the principle of least privilege for privileged accounts such as the service account in Kubernetes. |
| ID | Data Source | Data Component |
|---|---|---|
| DS0017 | Command | Command Execution |
| DS0022 | File | File Access |
| DS0002 | User Account | User Account Authentication |
Establish centralized logging for the activity of container and Kubernetes cluster components. Monitor logs for actions that could be taken to gather credentials to container and cloud infrastructure, including the use of discovery API calls by new or unexpected users and APIs that access Docker logs.
It may be possible to detect adversary use of credentials they have obtained such as in Valid Accounts.