T1612 · Build Image on Host · MITRE ATT&CK

Detection Strategy for Build Image on Host

Enterprise

1 platform

AN1261 · Containers

Detection of container image build activity directly on the host using Docker or Kubernetes APIs. Defenders may observe Docker build requests, anomalous Dockerfile instructions (such as downloading code from unknown IPs), or creation of new images followed by immediate deployment. This behavior chain typically consists of an unexpected image creation event correlated with outbound network communication to non-standard or untrusted destinations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Image CreationDC0015	docker:daemon	docker build or POST /build API request
Network Connection CreationDC0082	NSM:Flow	outbound connections from host during or immediately after image build

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RegistryAllowList	Defines trusted registries for image pulls/builds. Builds referencing unapproved registries may indicate adversary behavior.
NewImageThreshold	Threshold for number of new custom images created in a given time window. Exceeding this threshold may indicate malicious builds.
TimeWindow	Defines correlation window (e.g., 5m) between suspicious build activity and subsequent network traffic anomalies.

AuditM1047

Audit images deployed within the environment to ensure they do not contain any malicious components.

Limit Access to Resource Over NetworkM1035

Limit communications with the container service to local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API on port 2375. Instead, communicate with the Docker API over TLS on port 2376.

Network SegmentationM1030

Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Privileged Account ManagementM1026

Ensure containers are not running as root by default. In Kubernetes environments, consider defining Pod Security Standards that prevent pods from running privileged containers.

Tests1Executorssh 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformscontainers

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Build Image On Host	containers	sh	—	2	Yes
Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image. Attack Commandsrun with `sh` docker build -t t1612 $PathtoAtomicsFolder/T1612/src/ docker run --name t1612_container --rm -d -t t1612 docker exec t1612_container ./test.sh Cleanup Commands docker stop t1612_container docker rmi -f t1612 Dependenciesrun with `sh` Description Verify docker is installed. Check Prereq Commands which docker Get Prereq Commands if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi Description Verify docker service is running. Check Prereq Commands sudo systemctl status docker --no-pager Get Prereq Commands sudo systemctl start docker GUID2db30061-589d-409b-b125-7b473944f9b3

Tests from Atomic Red Team (MIT licence) · technique definition

Build Image on Host T1612

Build Image on Host T1612

Offense vs defense T1612

Build Image on Host detection strategy DET0459

Detection Strategy for Build Image on Host

Log sources

Tunable fields

Offense vs defense T1612

Build Image on Host detection strategy DET0459

Detection Strategy for Build Image on Host

Log sources

Tunable fields

Build Image on Host detections T1612

Build Image on Host detections T1612