{"id":40660,"date":"2021-04-29T17:00:48","date_gmt":"2021-04-29T17:00:48","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=93408"},"modified":"2021-04-29T17:00:48","modified_gmt":"2021-04-29T17:00:48","slug":"center-for-threat-informed-defense-teams-up-with-microsoft-partners-to-build-the-attck-for-containers-matrix","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/center-for-threat-informed-defense-teams-up-with-microsoft-partners-to-build-the-attck-for-containers-matrix\/","title":{"rendered":"Center for Threat-Informed Defense teams up with Microsoft, partners to build the ATT&CK\u00ae for Containers matrix"},"content":{"rendered":"

The MITRE ATT&CK\u00ae for Containers matrix<\/a> was published today, establishing an industry knowledge base of attack techniques associated with containerization and related technologies that are increasingly more ubiquitous in the current computing landscape. Microsoft is happy to have contributed and worked closely with the Center for Threat-Informed Defense<\/a> and other partners to develop this framework for understanding and investigating this growing attack surface.<\/p>\n

\"The<\/p>\n

The ATT&CK for Containers builds on efforts including the threat matrix for Kubernetes<\/a> developed by the Azure Security Center<\/a> team for Azure Defender for Kubernetes<\/a>. The Center for Threat-Informed Defense expanded on this initial framework by documenting real-world attacks, with Microsoft and other partners providing guidance and feedback throughout the process.<\/p>\n

Building the ATT&CK for Containers matrix is helpful in understanding the risks associated with containers, including misconfigurations that are often the initial vector for attacks, as well as the specific implementation of attack techniques in the wild. This knowledge informs approaches for detecting threats, and thus helps in providing comprehensive protections, as more and more organizations adopt containers and container orchestration technologies like Kubernetes.<\/p>\n

Organizations use containers to package software code, configuration files and libraries, and dependencies to enable fast software development and deployment. Containerization involves abstracting the OS and hardware. This abstraction creates scenarios where users are unaware that the base image of a container has exploitable vulnerabilities or where users may not pay close attention to what libraries and binaries are present on the images they\u2019re using.<\/p>\n

The convenience of platform-agnostic deployment of containers can benefit software developers, but it can also potentially benefit attackers aiming to run malware on multiple platforms. In addition, the ease in the deployment of containers can mean containers with vulnerabilities can be distributed across an organization as part of normal deployment operations.<\/p>\n

Microsoft security coverage for threats and risks associated with containers<\/h2>\n

Microsoft delivers protection against container threats in two areas: on endpoints and on Kubernetes clusters.<\/p>\n

Microsoft Defender for Endpoint<\/a> detects threats on endpoints running container hosts, focusing on behavior commonly observed on endpoints, including stealing locally stored credentials for accessing the cloud, downloading and running malicious images, and privilege escalation from dockers to hosts. Below is a mapping of Microsoft Defender for Endpoint detections with the ATT&CK for Containers techniques.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
ATT&CK for Containers technique<\/strong><\/td>\nMicrosoft Defender for Endpoint detection<\/strong><\/td>\n<\/tr>\n
Valid Accounts<\/td>\n\n
    \n
  • Suspicious cloud credential access<\/li>\n
  • Unix credentials were illegitimately accessed<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Unsecured Credentials<\/td>\n\n
    \n
  • Suspicious cloud credential access<\/li>\n
  • Unix credentials were illegitimately accessed<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Build Image on Host<\/td>\n\n
    \n
  • Malicious Docker image run<\/li>\n
  • Suspicious network connection from Docker container<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Deploy Container<\/td>\n\n
    \n
  • Malicious Docker image run<\/li>\n
  • Suspicious network connection from Docker container<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
User Execution: Malicious Image<\/td>\n\n
    \n
  • Malicious Docker image run<\/li>\n
  • Suspicious network connection from Docker container<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Resource Hijacking<\/td>\n\n
    \n
  • Malicious Docker image run<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Container Resource Discovery<\/td>\n\n
    \n
  • Suspicious kubectl exploratory command sequence<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Exploit Public-Facing Application<\/td>\n\n
    \n
  • Suspicious connection to unsecured Docker daemon<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
Escape to Host<\/td>\n\n