T1543.005: Container Service
MITRE ATT&CK T1543.005: Container Service Technique details for Containers, with detection guidance, relationships and mapped CVEs.
Security context for executives and security teams
Container Service matters because a container runtime or cluster agent can become a persistence and privilege-escalation mechanism, not just an application platform component. If an attacker can create or modify Docker/Podman services, kubelet-adjacent behavior, Kubernetes DaemonSets, or node-targeted pods, they may keep workloads running across restarts or place containers onto selected nodes. For leaders, the key question is whether container administration is governed and monitored like privileged system administration.
Executive priority
Prioritize this where containers or Kubernetes support business-critical services. The risk is operational resilience and privileged access: persistent containers or cluster-wide DaemonSets can survive normal cleanup and may affect current and future nodes. Executives should ask whether container runtime access, Kubernetes workload creation, and node-level scheduling changes are controlled, logged, reviewed, and available as incident evidence.
Technical view
This is a Containers-platform sub-technique under Create or Modify System Process for persistence and privilege escalation. SOC and IR teams should validate visibility into container runtime activity such as Docker or Podman service/container restart behavior, Kubernetes workload creation and modification, DaemonSets, and pod specs that target nodes through nodeSelector or nodeName. Because ATT&CK provides no official detection text, use the related detection strategy DET0473 as direction: look for persistent or elevated container services created through runtime or cluster manipulation, then tune against expected administrative automation.
Likely telemetry
- Container runtime logs and events for Docker or Podman container creation, modification, restart policy changes, and privileged runtime use
- Host process or command execution records involving container management tools where collected
- Kubernetes API server audit logs for DaemonSet, Pod, and workload creation or modification
- Kubernetes object state and change history for DaemonSets, pod specs, nodeSelector, and nodeName fields
- Node-level service/configuration evidence for container runtime or kubelet-related changes
Detection direction
- Confirm whether DET0473-style logic is implemented for persistent or elevated container services rather than assuming generic endpoint rules cover containers.
- Baseline legitimate platform automation that creates DaemonSets, restart-always containers, or node-targeted pods to reduce false positives.
- Alert on unexpected changes that make containers persistent across restarts or deploy workloads broadly across nodes, especially DaemonSets and explicit node targeting.
- Correlate runtime events with identity context: which user, service account, or automation modified the container service or Kubernetes object.
- Review blind spots around unmanaged nodes, rootful Docker access, missing Kubernetes audit logging, and container runtime activity that is not forwarded to the SOC.
Mitigation priorities
- Apply User Account Management by limiting who can use container runtimes and Kubernetes workload-management capabilities, following least privilege.
- Apply Software Configuration controls to harden container runtime, Kubernetes, kubelet, and workload settings against unnecessary persistent or privileged execution paths.
- Review and approve DaemonSets, restart policies, node-targeting fields, and systemd-managed container configurations as privileged changes.
- Maintain incident-response runbooks for identifying and removing unauthorized persistent containers, DaemonSets, and node-targeted pods.
- Use change control and periodic review to ensure container service persistence mechanisms match approved operational requirements.
Additional notes and limits
The object is a sub-technique of T1543 Create or Modify System Process and is scoped to Containers with persistence and privilege-escalation tactics. Relationship context includes DET0473 as a detection strategy and mitigations M1018 User Account Management and M1054 Software Configuration. The official description supports Docker, Podman, Kubernetes DaemonSets, nodeSelector/nodeName scheduling, and containers configured as systemd services.
ATT&CK does not provide official detection text for this object, and the supplied relationship details do not include full detection logic. Local architecture determines the most important evidence sources, especially whether Kubernetes audit logs, runtime logs, host process telemetry, and configuration history are retained. This take does not assert active exploitation, attribution, or existing detection coverage.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Container Service
No official description is available in the imported ATT&CK source object.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.