Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via [Upload Malware](https://attack.mitre.org/techniques/T1608/001), and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.(Citation: Summit Route Malicious AMIs) Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: [Match Legitimate Resource Name or Location](https://attack.mitre.org/techniques/T1036/005)).(Citation: Aqua Security Cloud Native Threat Report June 2021)

Linked Issues

Issuelinks
Linktyp Issue
is related to Techniques
is blocked by Code Signing
is blocked by User Execution – Malicious Image (containers & IaaS) – pull/run → start → anomalous behavior (T1204.003)
is blocked by Network Intrusion Prevention
is blocked by User Training
is blocked by Audit
is blocked by Provenance
is blocked by Security, Compliance & Resilience Controls Oversight
is blocked by Secure Baseline Configurations
is blocked by Least Functionality
is blocked by Continuous Monitoring
is blocked by Malicious Code Protection (Anti-Malware)
is blocked by Endpoint File Integrity Monitoring (FIM)
is blocked by Phishing & Spam Protection
is blocked by Detonation Chambers (Sandboxes)
is blocked by Boundary Protection
is blocked by Data Flow Enforcement – Access Control Lists (ACLs)
is blocked by Product Tampering and Counterfeiting (PTC)
is blocked by Acquisition Strategies, Tools & Methods
is blocked by Software & Firmware Patching
is blocked by Vulnerability Scanning
Impressum Deutsch Englisch