TA0006 · CREDENTIAL ACCESS
Container API
Adversaries may gather credentials via APIs within a containers environment. APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.
Detect it with
Establish centralized logging for the activity of container and Kubernetes cluster components.
Why it matters on shift
Container API is one of the concrete ways adversaries achieve credential access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After credential access, the next tactic is usually Discovery. Search your telemetry for the transition before closing the ticket.
Kill-chain context