aol.pm

Deploy Container

Technique · ATTACK:enterprise:T1610

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1610",
  "title": "Deploy Container",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1610",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--56e0d8b8-3e25-49dd-9050-3aa252f5aa92",
  "external_id": "T1610",
  "domain": "enterprise",
  "created": "2021-03-29T16:51:26.020Z",
  "modified": "2026-05-12T15:12:00.634Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "execution"
  ],
  "source_references": [
    {
      "source_name": "AppSecco Kubernetes Namespace Breakout 2020",
      "url": "https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216"
    },
    {
      "source_name": "Aqua Build Images on Hosts",
      "url": "https://blog.aquasec.com/malicious-container-image-docker-container-host"
    },
    {
      "source_name": "Docker Container",
      "url": "https://docs.docker.com/reference/cli/docker/container/create/"
    },
    {
      "source_name": "Kubernetes Workload Management",
      "url": "https://kubernetes.io/docs/concepts/workloads/controllers/"
    },
    {
      "source_name": "Kubeflow Pipelines",
      "url": "https://www.kubeflow.org/docs/components/pipelines/overview/pipelines-overview/"
    },
    {
      "source_name": "Kubernetes Dashboard",
      "url": "https://kubernetes.io/docs/tasks/access-application-cluster/web-ui-dashboard/"
    }
  ]
}

Explicit source assertions (11)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--102ece09-4129-4662-b05c-243709cd7d1d

Aqua Kinsing April 2020

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25746c12-2e93-4b62-bc08-b0108b37252e

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--264f59d1-abb8-4f79-8a32-49879700af15

Kubernetes RBAC

ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32fce5a7-7893-4da5-910d-5fd50d1a4248

Wiz TeamPCP KICS MAR 2026

ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3e62e520-0104-4be7-b4e2-d68fa88d7067

Cisco Talos Intelligence Group · Trend Micro TeamTNT · Intezer TeamTNT September 2020

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4eda0bd3-66e3-4773-9616-78ab8f60cbd5

Kubernetes Hardening Guide

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f3caebf-2c07-45de-b2f3-622dc8fcf59e

ATTACK:enterprise:S0683 → uses → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--71d8ce83-3410-4bf2-b30c-a3aa4c8a931d

Peirates GitHub

ATTACK:enterprise:S0600 → uses → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--78f508b9-0b72-4825-a076-9924eb9291fe

Intezer Doki July 20

ATTACK:enterprise:M1035 → mitigates → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e87accb-6851-4438-8673-e3682dae807f

Docker Daemon Socket Protect · Kubernetes Cloud Native Security · Microsoft AKS Azure AD 2023 · Kubernetes API Control Access

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1610

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0902604-d508-4945-8343-87bb96789c60

Palo Alto TeamPCP MAR 2026

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.