Home/ MITRE Matrix/ Execution/ T1610

T1610Deploy Container

T1610 — Deploy Container is a MITRE ATT&CK technique in the Execution tactic. Clankerusecase tracks 6 detection use cases covering it and 4 threat-intel articles citing it.

Execution

View on the matrix → Filter Detection Library MITRE official spec ↗

6Use cases

4Articles

0Sub-techniques

1Tactic

Use cases covering this technique (6)

[WEEKLY] Public-Facing App Runtime Spawns Shell, LOLBin, or Container-Control Tool Internal exploit · alerting DSΣPDD Linux Suspicious Docker Build Command Execution ESCU actions · hunting P Linux Suspicious Privileged Container Execution ESCU actions · hunting P [LLM] Docker / Kubernetes pull of compromised ghcr.io/elementary-data/elementary image Bespoke delivery · alerting DSΣPDDCS [LLM] Kubernetes privileged-pod DaemonSet fan-out from compromised LiteLLM workload Bespoke actions · hunting SPDD [LLM] Host runc binary overwrite from container (CVE-2019-5736 escape-to-host) Bespoke install · alerting DSΣPCS

Articles citing this technique (4)

high elementary-data Compromised on PyPI and GHCR: Forged Release Pushed via GitHub Actions Script Injection art-502

high You Patched LiteLLM, But Do You Know Your AI Blast Radius? art-579

crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605

crit A serious security flaw in runC can result in root privilege escalation in Docker and Kubernetes art-3587