User Execution: Malicious Image T1204.003

Tactic: Execution

Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via Upload Malware, and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.

Authoring guide

These 10 rules share fields, values, and exclusions.

Fields filtered most (12 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
sourcetype9eq 9aws:cloudtrail, aws:asl, cisco:isovalent:processexec
aws::eventName7eq 7putimage, describeimagescanfindings
aws::eventSource5eq 5ecr.amazonaws.com
severity3eq 2, in 1high, informational, low, medium, unknown
All_Risk.analyticstories1eq 1dev sec ops
All_Risk.risk_object_type1eq 1other
hour1ge 1, lt 120, 8
pod_name1ne 1
process_name1in 1*/, ---, /
source_count1gt 13
sum_risk_score1gt 1100
weekday1cross_field_compare 1Saturday, Sunday

Top indicator values (87 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
aws::eventSourceeq
ecr.amazonaws.com
57
sourcetypeeq
aws:cloudtrail
559
sourcetypeeq
aws:asl
227
sourcetypeeq
cisco:isovalent:processexec
28
aws::eventNameeq
putimage
44
aws::eventNameeq
describeimagescanfindings
33
All_Risk.analyticstorieseq
dev sec ops
1
All_Risk.risk_object_typeeq
other
1
hourge
20
1
hourlt
8
1
process_namein
*/
1
process_namein
---
1
process_namein
/
1
process_namein
/*
1
process_namein
access
1
process_namein
amap
1
process_namein
beef-xss
1
process_namein
bloodhound
1
process_namein
covenant
1
process_namein
cracking
1
process_namein
crackmapexec
13
process_namein
credential
1
process_namein
crowbar
1
process_namein
dirtycow
1
process_namein
dirtypipe
1
process_namein
dnsenum
1
process_namein
dnsrecon
1
process_namein
empire
1
process_namein
enum4linux
1
process_namein
enumeration
1

Exclusions (7 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
pod_image_namein
docker.io/grafana/grafana:12.0.1
1
pod_image_namein
docker.io/library/ubuntu:22.04
1
pod_image_namein
quay.io/isovalent-dev/tetragon-ci*
1
pod_image_namein
quay.io/isovalent/hubble-export-fluentd*
1
pod_image_namein
quay.io/isovalent/tetragon-ci*
1
usereq
admin
1
usereq
user
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Splunk 10 rules