Adversaries may deploy a container into an environment to facilitate execution or evade defenses. In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware. In others, an adversary may deploy a new container configured without network rules, user limitations, etc. to bypass existing defenses within the environment. In Kubernetes environments, an adversary may attempt to deploy a privileged or vulnerable container into a specific node in order to [Escape to Host](https://attack.mitre.org/techniques/T1611) and access other containers running on the node. (Citation: AppSecco Kubernetes Namespace Breakout 2020)

Containers can be deployed by various means, such as via Docker's <code>create</code> and <code>start</code> APIs or via a web application such as the Kubernetes dashboard or Kubeflow. (Citation: Docker Containers API)(Citation: Kubernetes Dashboard)(Citation: Kubeflow Pipelines) In Kubernetes environments, containers may be deployed through workloads such as ReplicaSets or DaemonSets, which can allow containers to be deployed across multiple nodes.(Citation: Kubernetes Workload Management) Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.(Citation: Aqua Build Images on Hosts)
Deploy Container
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1610  external_id: T1610     source_name: AppSecco Kubernetes Namespace Breakout 2020  description: Abhisek Datta. (2020, March 18). Kubernetes Namespace Breakout using Insecure Host Path Volume — Part 1. Retrieved January 16, 2024.  url: https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216     source_name: Aqua Build Images on Hosts  description: Assaf Morag. (2020, July 15). Threat Alert: Attackers Building Malicious Images on Your Hosts. Retrieved March 29, 2021.  url: https://blog.aquasec.com/malicious-container-image-docker-container-host     source_name: Docker Containers API  description: Docker. (n.d.). Docker Engine API v1.41 Reference - Container. Retrieved March 29, 2021.  url: https://docs.docker.com/engine/api/v1.41/#tag/Container     source_name: Kubernetes Workload Management  description: Kubernetes. (n.d.). Workload Management. Retrieved March 28, 2024.  url: https://kubernetes.io/docs/concepts/workloads/controllers/     source_name: Kubeflow Pipelines  description: The Kubeflow Authors. (n.d.). Overview of Kubeflow Pipelines. Retrieved March 29, 2021.  url: https://www.kubeflow.org/docs/components/pipelines/overview/pipelines-overview/     source_name: Kubernetes Dashboard  description: The Kubernetes Authors. (n.d.). Kubernetes Web UI (Dashboard). Retrieved March 29, 2021.  url: https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/     