Cyber Wiki Learning Path
MITRE ATT&CK® for Containers
Focus ATT&CK study on Containers behavior, defensive context, telemetry, investigation, and architecture.
Recommended Sequence
39 connected entries
Application Allowlisting
Application allowlisting permits only approved executables, scripts, libraries, installers, or other code to run under defined rules.
ATT&CK technique profile · IntermediateApplication Layer Protocol (T1071)
An adversary uses common application protocols such as web, DNS, mail, or file transfer to carry command-and-control traffic.
Threat and attack concept · IntermediateCommand and Control Channels
Command and Control Channels is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
Detection practice · IntermediateCommand and Control Detection
Command and control detection identifies the channels, timing patterns, protocol misuse, infrastructure, and host behavior used to direct compromised systems.
ATT&CK technique profile · IntermediateCommand and Scripting Interpreter (T1059)
An adversary uses a shell, command interpreter, scripting language, or administrative console to execute instructions and automate activity.
ATT&CK technique profile · IntermediateData Encrypted for Impact (T1486)
An adversary encrypts files, databases, virtual machines, or other information to disrupt availability and pressure the victim.
Detection practice · IntermediateData Exfiltration Detection
Data exfiltration detection looks for unauthorized movement of information through network, cloud, endpoint, application, and removable-media paths.
Threat and attack concept · IntermediateData Staging and Exfiltration
Data Staging and Exfiltration describes an adversary technique, campaign pattern, or malicious capability. Defenders study the conditions that make it possible, the behaviors it produces, and the controls that can prevent, detect, contain, and recover from it.
Detection engineering practice · AdvancedDetection as Code
Detection as code manages analytic rules, queries, parsers, tests, documentation, and deployment through version-controlled engineering practices so detection changes are reviewable, reproducible, testable, and safely promoted.
ATT&CK legacy profile · IntermediateDisable or Modify Tools (Legacy T1562.001)
Disable or Modify Tools (T1562.001) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
ATT&CK technique profile · IntermediateEncrypted Channel (T1573)
An adversary protects command traffic with encryption or an encrypted protocol to conceal content and complicate inspection.
ATT&CK technique profile · IntermediateExfiltration Over C2 Channel (T1041)
An adversary sends collected data through the same command-and-control channel used to manage compromised systems.
ATT&CK technique profile · IntermediateExfiltration Over Web Service (T1567)
An adversary uploads information through a web service, cloud-storage provider, code-sharing service, or other internet platform that may resemble normal use.
ATT&CK technique profile · IntermediateExploit Public-Facing Application (T1190)
An adversary exploits a weakness in an internet-accessible application, service, appliance, management interface, or workload to gain access.
ATT&CK technique profile · IntermediateExploitation for Privilege Escalation (T1068)
An adversary exploits a software or configuration weakness to cross a local or workload privilege boundary.
Application security concept · IntermediateFile Upload Security
File Upload Security is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
ATT&CK technique profile · IntermediateHide Artifacts (T1564)
An adversary conceals files, directories, processes, windows, accounts, services, or cloud resources from ordinary inspection.
ATT&CK legacy profile · IntermediateImpair Defenses (Legacy T1562)
Impair Defenses (T1562) is retained as a historical ATT&CK mapping. Enterprise ATT&CK v19.2 reorganized this behavior; use the linked current successor profiles for active catalog mapping.
ATT&CK technique profile · IntermediateIndicator Removal (T1070)
An adversary deletes or alters logs, files, timestamps, command history, accounts, or other evidence to reduce the visible record of activity.
ATT&CK technique profile · IntermediateIngress Tool Transfer (T1105)
An adversary transfers tools or files from an external location into a compromised environment, often through an existing command channel.
Security operations process · IntermediateLog Source Onboarding
Log source onboarding is the controlled process of bringing a new event source into security monitoring with validated collection, parsing, timestamps, identifiers, access controls, retention, health checks, and documented analytic value.
Framework learning hub · All levelsMITRE ATT&CK® Educational Learning Center
A structured, versioned learning center that connects Enterprise ATT&CK adversary behavior to architecture, telemetry, detection, mitigation, investigation, recovery, and Bare Metal Cyber coursework.
Framework scope · IntermediateMITRE ATT&CK® Platforms and Technology Scope
How ATT&CK platform metadata helps analysts distinguish Windows, Linux, macOS, cloud, identity, SaaS, containers, network devices, ESXi, and pre-compromise activity.
ATT&CK technique profile · IntermediateMasquerading (T1036)
An adversary makes an artifact, process, account, service, or task appear legitimate by using misleading names, locations, metadata, or presentation.
Network monitoring concept · AdvancedNetwork Traffic Analysis
Network traffic analysis examines packet, flow, DNS, proxy, TLS, routing, and session metadata to understand communication patterns, identify suspicious behavior, and reconstruct activity across network trust boundaries.
ATT&CK technique profile · IntermediateObfuscated Files or Information (T1027)
An adversary encodes, encrypts, packs, fragments, or otherwise transforms files and information to make discovery or analysis more difficult.
Security operations practice · IntermediatePacket Capture and PCAP Analysis
Packet Capture and PCAP Analysis is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
ATT&CK technique profile · IntermediateProcess Discovery (T1057)
An adversary lists running processes, services, containers, or workloads to identify security tools, applications, users, and possible targets.
Attack pattern · BeginnerRansomware
Ransomware operations disrupt access to systems or data and may combine encryption with theft, extortion, public pressure, and attacks on recovery systems.
ATT&CK technique profile · IntermediateScheduled Task/Job (T1053)
An adversary creates or modifies a scheduled task, cron job, cloud schedule, or similar mechanism to run code at a chosen time or event.
ATT&CK technique profile · IntermediateServer Software Component (T1505)
An adversary adds or modifies a component within server software—such as a web shell, plug-in, module, or management extension—to preserve access or execute code.
Application security concept · IntermediateServer-Side Request Forgery
Server-Side Request Forgery is an application-security topic involving trust boundaries, input handling, browser or API behavior, identity, authorization, or server-side processing.
Security operations practice · IntermediateSigma Rules
Sigma Rules is an operational security practice used to collect evidence, detect suspicious behavior, investigate events, or guide incident decisions.
Security operations practice · IntermediateSysmon
Sysmon is a cybersecurity concept used to describe, protect, analyze, or operate an important part of a modern information environment.
ATT&CK technique profile · IntermediateSystem Network Configuration Discovery (T1016)
An adversary queries addresses, interfaces, routes, DNS settings, proxies, adapters, and other network configuration to understand connectivity.
Proactive analysis · AdvancedThreat Hunting
Threat hunting is a structured search for adversary behavior or hidden compromise that has not been fully identified by existing alerts.
ATT&CK technique profile · IntermediateUnsecured Credentials (T1552)
An adversary searches files, repositories, scripts, logs, environment variables, instance metadata, or configuration for exposed authentication material.
Application security concept · IntermediateWeb Application Attack Classes
Web application attack classes include injection, broken access control, authentication failures, insecure design, misconfiguration, component risk, request forgery, and unsafe handling of data and sessions.
Malware detection concept · AdvancedYARA Rules
YARA is a pattern-matching language used to classify files, memory, and other byte or text content by combining strings, metadata, modules, and Boolean conditions into reusable detection rules.