Adversaries may create or modify container or container cluster management tools that run as daemons, agents, or services on individual hosts.

Tactics
TA0003 TA0004

Sub-technique of
T1543


See: MITRE ATT&CK