{'created': '2024-02-15T13:41:46.784Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': 'Adversaries may create or modify container or container '
                'cluster management tools that run as daemons, agents, or '
                'services on individual hosts. These include software for '
                'creating and managing individual containers, such as Docker '
                'and Podman, as well as container cluster node-level agents '
                'such as kubelet. By modifying these services, an adversary '
                'may be able to achieve persistence or escalate their '
                'privileges on a host.\n'
                '\n'
                'For example, by using the `docker run` or `podman run` '
                'command with the `restart=always` directive, a container can '
                'be configured to persistently restart on the host.(Citation: '
                'AquaSec TeamTNT 2023) A user with access to the (rootful) '
                'docker command may also be able to escalate their privileges '
                'on the host.(Citation: GTFOBins Docker)\n'
                '\n'
                'In Kubernetes environments, DaemonSets allow an adversary to '
                'persistently [Deploy '
                'Container](https://attack.mitre.org/techniques/T1610)s on all '
                'nodes, including ones added later to the cluster.(Citation: '
                'Aquasec Kubernetes Attack 2023)(Citation: Kubernetes '
                'DaemonSet) Pods can also be deployed to specific nodes using '
                'the `nodeSelector` or `nodeName` fields in the pod '
                'spec.(Citation: Kubernetes Assigning Pods to Nodes)(Citation: '
                'AppSecco Kubernetes Namespace Breakout 2020)\n'
                '\n'
                'Note that containers can also be configured to run as '
                '[Systemd '
                'Service](https://attack.mitre.org/techniques/T1543/002)s.(Citation: '
                'Podman Systemd)(Citation: Docker Systemd)',
 'external_references': [{'external_id': 'T1543.005',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/techniques/T1543/005'},
                         {'description': 'Abhisek Datta. (2020, March 18). '
                                         'Kubernetes Namespace Breakout using '
                                         'Insecure Host Path Volume — Part 1. '
                                         'Retrieved January 16, 2024.',
                          'source_name': 'AppSecco Kubernetes Namespace '
                                         'Breakout 2020',
                          'url': 'https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216'},
                         {'description': 'Docker. (n.d.). Start containers '
                                         'automatically. Retrieved February '
                                         '15, 2024.',
                          'source_name': 'Docker Systemd',
                          'url': 'https://docs.docker.com/config/containers/start-containers-automatically/'},
                         {'description': 'GTFOBins. (n.d.). docker. Retrieved '
                                         'February 15, 2024.',
                          'source_name': 'GTFOBins Docker',
                          'url': 'https://gtfobins.github.io/gtfobins/docker/'},
                         {'description': 'Kubernetes. (n.d.). Assigning Pods '
                                         'to Nodes. Retrieved February 15, '
                                         '2024.',
                          'source_name': 'Kubernetes Assigning Pods to Nodes',
                          'url': 'https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/'},
                         {'description': 'Kubernetes. (n.d.). DaemonSet. '
                                         'Retrieved February 15, 2024.',
                          'source_name': 'Kubernetes DaemonSet',
                          'url': 'https://kubernetes.io/docs/concepts/workloads/controllers/daemonset/'},
                         {'description': 'Michael Katchinskiy, Assaf Morag. '
                                         '(2023, April 21). First-Ever Attack '
                                         'Leveraging Kubernetes RBAC to '
                                         'Backdoor Clusters. Retrieved July '
                                         '14, 2023.',
                          'source_name': 'Aquasec Kubernetes Attack 2023',
                          'url': 'https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters'},
                         {'description': 'Ofek Itach and Assaf Morag. (2023, '
                                         'July 13). TeamTNT Reemerged with New '
                                         'Aggressive Cloud Campaign. Retrieved '
                                         'February 15, 2024.',
                          'source_name': 'AquaSec TeamTNT 2023',
                          'url': 'https://blog.aquasec.com/teamtnt-reemerged-with-new-aggressive-cloud-campaign'},
                         {'description': 'Valentin Rothberg. (2022, March 16). '
                                         'How to run pods as systemd services '
                                         'with Podman. Retrieved February 15, '
                                         '2024.',
                          'source_name': 'Podman Systemd',
                          'url': 'https://www.redhat.com/sysadmin/podman-run-pods-systemd-services'}],
 'id': 'attack-pattern--b0e54bf7-835e-4f44-bd8e-62f431b9b76a',
 'kill_chain_phases': [{'kill_chain_name': 'mitre-attack',
                        'phase_name': 'persistence'},
                       {'kill_chain_name': 'mitre-attack',
                        'phase_name': 'privilege-escalation'}],
 'modified': '2025-04-15T22:10:00.252Z',
 'name': 'Container Service',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'attack-pattern',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_deprecated': False,
 'x_mitre_detection': '',
 'x_mitre_domains': ['enterprise-attack'],
 'x_mitre_is_subtechnique': True,
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_platforms': ['Containers'],
 'x_mitre_version': '1.0'}