Home/ MITRE Matrix/ Execution/ T1609

T1609Container Administration Command

T1609 — Container Administration Command is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 2 detection use cases covering it and 2 threat-intel articles citing it.

Execution

View on the matrix → Filter Detection Library MITRE official spec ↗

2Use cases

2Articles

0Sub-techniques

1Tactic

Use cases covering this technique (2)

[LLM] Lateral movement via aws ssm send-command or kubectl exec spawned by python/node Bespoke actions · alerting DSΣPDDCSCW [LLM] GitHub Actions self-hosted runner spawning curl/wget POST to non-allowlisted egress Bespoke exploit · hunting DSPDDCS

Articles citing this technique (2)

high Why EDR and proxy won’t save you from supply chain malware art-142

high GhostAction Campaign: Over 3,000 Secrets Stolen Through Malicious GitHub Workflows art-785