Using ATT&CK® for Containers to Level Up your Cloud Defenses

### Overview In this presentation at Forward CloudSec, Jen Burns—a senior security engineer at HubSpot and former MITRE ATT&CK for Cloud lead—discusses the origins, architecture, and practical applications of MITRE ATT&CK for Containers. ATT&CK serves as a free, globally accessible, community-driven knowledge base documenting real-world adversary behaviors rather than theoretical attacks. Grounded in David Bianco's Pyramid of Pain, ATT&CK targets tactics, techniques, and procedures (TTPs) at the top of the pyramid, offering higher defensive value than focusing solely on easily changed indicators like hashes or IP addresses.

### Key Topics - **Expansion of ATT&CK to Containers**: ATT&CK originally covered Windows in 2014, expanding to Linux, macOS, ICS, Cloud, and network devices. Containers became a logical expansion supported by the Center for Threat-Informed Defense (CTID, part of MITRE Engenuity), Microsoft's Kubernetes threat matrix work, and community demand. While most observed wild container attacks historically resulted in cryptomining, adversaries also leverage containers for traditional objectives like collection and data exfiltration. - **Matrix Structure**: Organized by tactical adversary goals (such as initial access, persistence, and privilege escalation) down to specific techniques and sub-techniques. Techniques include applicable platforms, required detection data sources, mitigations, detection guidance, and observed real-world procedure examples. - **Core Defensive Use Cases**: The talk outlines three primary operational use cases: assessment and engineering, threat intelligence, and adversary emulation.

### Technical Details - **Assessments and Engineering**: Teams can measure detection confidence and mitigation status using heat maps in tools like the ATT&CK Navigator. Burns demonstrates assessing the "External Remote Services" technique in container environments by evaluating potential exposed attack surfaces: - *Docker Daemon/API*: Checking if TCP port 2375 is exposed, restricted by security groups or iptables, or disabled, alongside collecting Docker daemon logs. - *Kubernetes API Server*: Verifying authentication requirements, external exposure vs. private VPC isolation, and collecting Kubernetes audit logs for anomalous access. - *Kubelet*: Enforcing controls such as webhook token authentication and gathering kubelet logs. - *Management Interfaces*: Securing web dashboards and container management interfaces with authentication. - **Threat Intelligence & Mapping**: Real-world threat reports can be mapped directly to ATT&CK techniques. Burns references a Palo Alto Networks threat report on the Hildegard malware attributed to TeamTNT. The attack sequence maps to: - Initial access via command execution on anonymous kubelets (*External Remote Services*). - Command execution inside containers using the kubelet API. - Breaking out of containers (*Escape to Host*). - Accessing cloud resources (*Unsecured Credentials: Cloud Instance Metadata API*), transitioning into the IaaS matrix. - **Adversary Emulation & Tooling**: Threat reports and procedure examples for container-focused malware (such as Kinsing, Hildegard, and Doki) guide emulation exercises. Burns highlights several third-party security and testing tools: - `redcube`: A collection of `kubectl` commands for testing. - `kube-hunter`: Scans clusters for security weaknesses. - `Kubernetes Goat`: An interactive environment to practice adversary emulation safely. - `kubescape`: Validates configurations against NSA and CISA Kubernetes hardening guidance. - `kube-bench`: Checks deployments against the CIS Kubernetes benchmarks.

### Takeaways ATT&CK for Containers provides blue and red teams with a shared taxonomy grounded in observed adversary activity. Defenders can systematically evaluate coverage, prioritize log sources (like Kubernetes audit and Docker daemon logs), compare security vendor tooling, and emulate actual threat actors (like TeamTNT) to validate both mitigations and detections without discarding standard compliance and hardening baselines.