Cross-source coverage
T1204.003 / ATT&CK
User Execution: Malicious Image
13 rules across 2 sources.
1 atomic-IOC hidden · include
From MITRE ATT&CK 19.2
Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via Upload Malware, and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.
Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: Match Legitimate Resource Name or Location).
- Tactics
- Execution
- Platforms
- IaaS · Containers
- Telemetry
-
containerd:eventskubernetes:auditkubernetes:eventsauditd:SYSCALLNSM:FlowAWS:CloudTrailazure:activityWinEventLog:Sysmon
How MITRE says to detect it DET0248
User Execution – Malicious Image (containers & IaaS) – pull/run → start → anomalous behavior (T1204.003)
Linux Analytic 0691
CONTAINERS (Docker/K8s/containerd): A user pulls an untrusted image from a public/unknown registry and then creates/starts a container from that image. Shortly after start, the container spawns unexpected utilities (e.g., curl/wget/bash/python), or makes outbound network connections atypical for the namespace/workload. The analytic correlates Image Creation/Download → Container Creation → Container Start → Command Execution/Network activity within a short window and with a consistent image digest.
containerd:eventsImage pull from untrusted registry (name NOT IN allowlist) or new digest never seen beforekubernetes:auditcreate: Pod/Container created with image tag 'latest' or mutable tag; imagePullPolicy=Always; noDigest=truekubernetes:eventsstart: ContainerStarted or Pulling image → Started containerauditd:SYSCALLexecve: Process in container namespace executes curl|wget|bash|sh|python|nc with outbound argsNSM:FlowNew egress from container IP/namespace to Internet or non-approved CIDRs/ASNs
Windows Analytic 0692
IAAS (Cloud images/VMs): A new VM/instance is launched from a non-approved or newly-seen image (AMI/GCP Image/Azure Image). On first boot, cloud-init/user-data or embedded agents download code, spawn system utilities, or open outbound C2/mining traffic. The analytic correlates Instance/Image Creation → Instance Start → in-guest Process/Command Execution and/or anomalous network traffic.
AWS:CloudTrailRunInstancesazure:activityMicrosoft.Compute/virtualMachines/write: imageReference publisher NOT IN allowlist OR plan is new/unknownWinEventLog:SysmonEventCode=1NSM:FlowNew VM egress to crypto-mining pools or non-approved Internet ranges within minutes of boot
splunk/security_content
10 rules| Detection | Severity | Format |
|---|---|---|
| ASL AWS ECR Container Upload Outside Business Hours | Undefined | SPL |
| ASL AWS ECR Container Upload Unknown User | Undefined | SPL |
| AWS ECR Container Scanning Findings High | Undefined | SPL |
| AWS ECR Container Scanning Findings Low Informational Unknown | Undefined | SPL |
| AWS ECR Container Scanning Findings Medium | Undefined | SPL |
| AWS ECR Container Upload Outside Business Hours | Undefined | SPL |
| AWS ECR Container Upload Unknown User | Undefined | SPL |
| Cisco Isovalent - Non Allowlisted Image Use | Undefined | SPL |
| Cisco Isovalent - Pods Running Offensive Tools | Undefined | SPL |
| Risk Rule for Dev Sec Ops by Repository | Undefined | SPL |