AN0946
Analytic 0946
Containers
Implantation of malicious code into container images followed by registry push and use in new deployments.
docker:daemon
docker build or docker commit commands followed by docker push to internal registry
docker:registry
push event of new image version from unrecognized user or context
[TimeWindow]
Time threshold between image creation and use in deployment – typically rapid in adversarial activity.
[UserContext]
The expected users or service accounts performing image pushes.
[RegistryNameRegex]
Expected naming patterns for trusted registries.
AN0947
Analytic 0947
IaaS
Creation or modification of cloud virtual machine images (AMIs, custom images) with persistence mechanisms, followed by infrastructure provisioning that uses these implanted images.
AWS:CloudTrail
RegisterImage
AWS:CloudTrail
ModifyImageAttribute
AWS:CloudTrail
RunInstances
[IAMRole]
Roles that are allowed to register and modify images should be scoped narrowly.
[ImageTagRegex]
Expected tags or naming patterns for images (e.g., 'golden-image', 'base-image').
[LaunchWindow]
Time interval between image creation and instance launch.