Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.(Citation: Docker API)(Citation: Kubernetes API)
An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.(Citation: Unit 42 Unsecured Docker Daemons) An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server. These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| AC-17 | Remote Access | Protects | T1552.007 | Container API | |
| AC-2 | Account Management | Protects | T1552.007 | Container API | |
| AC-23 | Data Mining Protection | Protects | T1552.007 | Container API | |
| AC-3 | Access Enforcement | Protects | T1552.007 | Container API | |
| AC-4 | Information Flow Enforcement | Protects | T1552.007 | Container API | |
| AC-5 | Separation of Duties | Protects | T1552.007 | Container API | |
| AC-6 | Least Privilege | Protects | T1552.007 | Container API | |
| CM-5 | Access Restrictions for Change | Protects | T1552.007 | Container API | |
| CM-6 | Configuration Settings | Protects | T1552.007 | Container API | |
| CM-7 | Least Functionality | Protects | T1552.007 | Container API | |
| IA-2 | Identification and Authentication (organizational Users) | Protects | T1552.007 | Container API | |
| SC-46 | Cross Domain Policy Enforcement | Protects | T1552.007 | Container API | |
| SC-7 | Boundary Protection | Protects | T1552.007 | Container API | |
| SC-8 | Transmission Confidentiality and Integrity | Protects | T1552.007 | Container API |
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_config | AWS Config | technique_scores | T1552.007 | Container API |
Comments
The "eks-endpoint-no-public-access" managed rule can identify whether Amazon Elastic Kubernetes Service (Amazon EKS) endpoints are misconfigured to allow public endpoint access, which should be fixed in order to prevent malicious external access to the Kubernetes API server, including malicious attempts to gather credentials via the API. The "eks-secrets-encrypted" managed rule can identify configuration problems that should be fixed in order to ensure that Kubernetes secrets (including those containing credentials) are encrypted to prevent malicious access. Both controls are run periodically and only provide partial coverage because they are specific to public access and adversaries without the ability to decrypt secrets, respectively, resulting in an overall score of Partial.
References
|