Pod

A single unit of shared resources within a cluster, comprised of one or more containers^[1]^[2]

ID: DS0014

ⓘ

Platform: Containers

ⓘ

Collection Layer: Container

Contributors: Center for Threat-Informed Defense (CTID)

Version: 1.0

Created: 20 October 2021

Last Modified: 10 November 2021

Data Components

Initial construction of a new pod (ex: kubectl apply|run)

Initial construction of a new pod (ex: kubectl apply|run)

Domain	ID		Name	Detects
Enterprise	T1610		部署容器	Monitor for newly constructed pods that may deploy a container into an environment to facilitate execution or evade defenses.

An extracted list of pods within a cluster (ex: kubectl get pods)

An extracted list of pods within a cluster (ex: kubectl get pods)

Domain	ID		Name	Detects
Enterprise	T1613		容器与资源发现	Monitor logs for actions that could be taken to gather information about pods, including the use of discovery API calls by new or unexpected users. Monitor account activity logs to see actions performed and activity associated with the Kubernetes dashboard and other web applications.

Changes made to a pod, including its settings and/or control data (ex: kubectl set|patch|edit)

Changes made to a pod, including its settings and/or control data (ex: kubectl set|patch|edit)

Domain	ID		Name	Detects
Enterprise	T1610		部署容器	Monitor for changes made to pods for unexpected modifications to settings and/or control data that may deploy a container into an environment to facilitate execution or evade defenses.