DC0091 Container Enumeration
| Item | Value |
|---|---|
| ID | DC0091 |
| Version | 2.0 |
| Created | 20 October 2021 |
| Last Modified | 12 November 2025 |
Log Sources
| Name | Channel |
|---|---|
| AWS:CloudTrail | DescribeCluster, ListClusters, ListNodegroups |
| containerd:runtime | e.g., containerd, Docker events |
| docker:daemon | docker ps, docker inspect, or docker images commands |
Detection Strategy
| ID | Name | Technique Detected |
|---|---|---|
| DET0490 | Detection Strategy for Container and Resource Discovery | T1613 |
| DET0514 | Detection Strategy for Exploitation for Privilege Escalation | T1068 |