THREAT OPS › Threat News › Mythic Embarking on the Open Seas: Containerized Payload Delivery for Kubernetes Assessments
Mythic Embarking on the Open Seas: Containerized Payload Delivery for Kubernetes Assessments
<p class="wp-block-paragraph"><em><strong>TL;DR: </strong>We created new Mythic extensions to simplify container-centric assessments, including Kubernetes and Docker-based ceded access workflows. These tools help operators wrap Mythic payloads in OCI-compatible containers and publish them to a self-hosted registry. Check the <a href="https://github.com/elreydetoda/container_wrapper">container_wrap
MITRE ATT&CK techniques
- Container RegistryAML.T0010.004
Indicators of compromise
- 193637f7ee8ae5f5aa5248f49e7baa3e6164966esha1
- 756939600b9a7180fc2df6550a4585b638875e67sha1
- 13d8eecf301b04590997b6b6316e8c107d69686csha1
- 8380b8ae158be0208f2a1f66cc79312fe2b7a92bsha1
- cc40eea45615263c2fe88f71677dc243ab659019sha1
- https://redcanary.com/threat-detection-report/trends/c2-frameworks/url
- https://www.wiz.io/blog/kubernetes-data-planeurl
- https://www.blackhillsinfosec.com/how-to-build-your-own-penetration-testing-drop-box/url
- https://opencontainers.org/url
- https://bluescreenofjeff.com/2018-04-12-https-payload-and-c2-redirectors/url
- http://httpd.apache.org/docs/current/mod/mod_rewrite.htmlurl
- http://{{url
- https://docs.mythic-c2.net/installationurl
- https://docs.mythic-c2.net/customizing/payload-type-development/payload-type-info/payload-type-definition#1-1-wrapper-payloadsurl
- https://docs.docker.com/reference/dockerfile/#entrypointurl
- https://kyverno.io/policies/best-practices/restrict-image-registries/restrict-image-registries/url
- https://kubernetes.io/docs/reference/setup-tools/kubeadm/url
- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/tactics/InitialAccess/url
- https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20villages/DEF%20CON%2032%20-%20Adversary%20Vilage%20-%20Leonidas%20Tsaousis%20-%20Kubernetes%20Attack%20Simulation%20-%20The%20Definitive%20Guide.pdfurl
- https://media.defcon.org/DEFurl
- https://distribution.github.io/distribution/about/deploying/url
- https://chatgpt.com/share/696fa24f-6944-8005-b364-aecc69de9ef2url
- docker.iodomain
- containerd.iodomain