TA0007 · DISCOVERY
Container and Resource Discovery
Adversaries may attempt to discover containers and other resources that are available within a containers environment. Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.
Detect it with
Establish centralized logging for the activity of container and Kubernetes cluster components. This can be done by deploying logging agents on Kubernetes nodes and retrieving logs from sidecar proxies for application pods to detect malicious activity at the cluster level.
Why it matters on shift
Container and Resource Discovery is one of the concrete ways adversaries achieve discovery. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After discovery, the next tactic is usually Lateral Movement. Search your telemetry for the transition before closing the ticket.
Kill-chain context