Home/ MITRE Matrix/ Discovery/ T1613

T1613Container and Resource Discovery

T1613 — Container and Resource Discovery is a MITRE ATT&CK technique in the Discovery tactic. Clankerusecase tracks 4 detection use cases covering it and 4 threat-intel articles citing it.

Discovery

View on the matrix → Filter Detection Library MITRE official spec ↗

4Use cases

4Articles

0Sub-techniques

1Tactic

Use cases covering this technique (4)

[LLM] Recon tool reading K8s service-account token or /proc/self/environ inside a container Bespoke recon · hunting DSΣPDDCS [LLM] Cilium Envoy admin socket abuse: TLS secret / config disclosure via admin.sock (CVE-2026-49445) Bespoke actions · hunting DSΣPDDCS [LLM] Fleet agent service account reads secrets across multiple namespaces (CVE-2026-44935) Bespoke actions · alerting SPDD [LLM] In-cluster Kubernetes secret enumeration with Python user-agent (litellm stealer K8s pivot) Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (4)

high Four incident-response decisions from the Hugging Face breach art-04

crit [GHSA / CRITICAL] CVE-2026-49445: Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket art-240

crit [GHSA / CRITICAL] CVE-2026-44935: Rancher Fleet vulnerable to cross namespace secret disclosure via unvalidated `valuesFrom` references in H art-268

crit litellm: Credential Stealer Hidden in PyPI Wheel art-545