Home/ MITRE Matrix/ Execution/ T1609

T1609Container Administration Command

T1609 — Container Administration Command is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 5 detection use cases covering it and 4 threat-intel articles citing it.

Execution

View on the matrix → Filter Detection Library MITRE official spec ↗

5Use cases

4Articles

0Sub-techniques

1Tactic

Use cases covering this technique (5)

[LLM] Logging-operator Flow/Output CRD injects Fluentd @type exec block (CVE-2026-54680) Bespoke delivery · alerting SΣPDD [LLM] Fluentd aggregator pod spawns shell/curl via injected out_exec (CVE-2026-54680 RCE) Bespoke exploit · alerting DSΣPDDCS [LLM] Lateral movement via aws ssm send-command or kubectl exec spawned by python/node Bespoke actions · alerting DSΣPDDCSCW [LLM] Kubernetes propagation via kubectl staged in /tmp (kubectl exec / get secrets) Bespoke actions · alerting DSΣPDDCS [LLM] Anonymous principal reaching kubelet/pod proxy subresources (CVE-2018-1002105 tunnel) Bespoke actions · alerting SΣPDDCW

Articles citing this technique (4)

crit [GHSA / CRITICAL] CVE-2026-54680: Logging operator has Fluentd configuration injection that allows remote code execution art-176

high Why EDR and proxy won’t save you from supply chain malware art-415

high Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again! art-469

high Critical Arbitrary Code Execution Vulnerability Found in Kubernetes art-3601