Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0248 — User Execution – Malicious Image (containers & IaaS) – pull/run → start → anomalous behavior (T1204.003)
DET0248

User Execution – Malicious Image (containers & IaaS) – pull/run → start → anomalous behavior (T1204.003)

2 analytic(s) · 1 technique(s) detected

Analytics

2
AN0691 Analytic 0691
Linux

CONTAINERS (Docker/K8s/containerd): A user pulls an untrusted image from a public/unknown registry and then creates/starts a container from that image. Shortly after start, the container spawns unexpected utilities (e.g., curl/wget/bash/python), or makes outbound network connections atypical for the namespace/workload. The analytic correlates Image Creation/Download → Container Creation → Container Start → Command Execution/Network activity within a short window and with a consistent image digest.

containerd:events Image pull from untrusted registry (name NOT IN allowlist) or new digest never seen before kubernetes:audit create: Pod/Container created with image tag 'latest' or mutable tag; imagePullPolicy=Always; noDigest=true kubernetes:events start: ContainerStarted or Pulling image → Started container auditd:SYSCALL execve: Process in container namespace executes curl|wget|bash|sh|python|nc with outbound args NSM:Flow New egress from container IP/namespace to Internet or non-approved CIDRs/ASNs
[ImageRegistryAllowList] Approved registries/namespaces (e.g., ECR/GCR/ACR org repos).
[TimeWindow] Correlation window from image pull to container activity (e.g., ≤15m).
[SuspiciousBinaries] Executables treated as high-risk when run in app containers (bash, sh, curl, wget, nc, powershell for Windows containers).
[NamespaceScope] K8s namespaces that should never pull from Internet or run mutable tags.
[OutboundCIDRBlockList] Destination networks/domains that should not be contacted by containers.
AN0692 Analytic 0692
Windows

IAAS (Cloud images/VMs): A new VM/instance is launched from a non-approved or newly-seen image (AMI/GCP Image/Azure Image). On first boot, cloud-init/user-data or embedded agents download code, spawn system utilities, or open outbound C2/mining traffic. The analytic correlates Instance/Image Creation → Instance Start → in-guest Process/Command Execution and/or anomalous network traffic.

AWS:CloudTrail RunInstances azure:activity Microsoft.Compute/virtualMachines/write: imageReference publisher NOT IN allowlist OR plan is new/unknown WinEventLog:Sysmon EventCode=1 NSM:Flow New VM egress to crypto-mining pools or non-approved Internet ranges within minutes of boot
[ApprovedImageCatalog] Set of golden images/owners and digest/IDs allowed to launch.
[UserDataInspection] Whether to alert when userData/cloud-init contains exec or download directives.
[FirstBootWindow] Time after start considered first-boot (e.g., ≤30m) for correlation.
[VMTagScope] Restrict detection to prod or internet-facing subnets to reduce noise.

Detected Techniques

1

Details

MITRE ID
DET0248
STIX ID
x-mitre-detection-strategy--ee7bd8ff-fbfd-4bb2-9d23-cf3f6ed342c7
Analytics
2
Techniques Detected
1
By Tactic
Execution
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.