Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)

In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as <code>docker exec</code> to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as <code>kubectl exec</code>.(Citation: Kubectl Exec Get Shell)
Container Administration Command
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1609  external_id: T1609     source_name: Docker Exec  description: Docker. (n.d.). Docker Exec. Retrieved March 29, 2021.  url: https://docs.docker.com/engine/reference/commandline/exec/     source_name: Docker Entrypoint  description: Docker. (n.d.). Docker run reference. Retrieved March 29, 2021.  url: https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime     source_name: Docker Daemon CLI  description: Docker. (n.d.). DockerD CLI. Retrieved March 29, 2021.  url: https://docs.docker.com/engine/reference/commandline/dockerd/     source_name: Kubectl Exec Get Shell  description: The Kubernetes Authors. (n.d.). Get a Shell to a Running Container. Retrieved March 29, 2021.  url: https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/     source_name: Kubernetes Kubelet  description: The Kubernetes Authors. (n.d.). Kubelet. Retrieved March 29, 2021.  url: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/     source_name: Kubernetes API  description: The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021.  url: https://kubernetes.io/docs/concepts/overview/kubernetes-api/     