Abuse of Container Management Platform

Where a Kubernetes API endpoint is reachable from the assessment source, an authenticated caller authorized for pods/exec can use the API to execute a command inside an existing container. Internet-origin use is possible when the endpoint is publicly reachable and network policy permits the caller's source; endpoint exposure varies by cluster and may be disabled or restricted. This behavior maps to ATT&CK T1609, Container Administration Command. It does not by itself deploy a container or grant access to the host; those behaviors are covered separately by T1610 and T1611.