tfMITRE ATT&CK technique

Build Image on Host T1612

Tactic: Stealth
Platform: Containers
Version: 2.0
Created: 30 March 2021
Last modified: 12 May 2026
Contributors: Assaf Morag, @MoragAssaf, Team Nautilus Aqua Security; Roi Kol, @roykol1, Team Nautilus Aqua Security; Michael Katchinskiy, @michael64194968, Team Nautilus Aqua Security; Vishwas Manral, McAfee

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malwareNone recorded

Tools & malwareNone recorded · 29% of ATT&CK techniques have none either.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Offense vs defense T1612

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Build Image on Host detection strategy DET0459

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Build Image on Host

Enterprise

1 platform

AN1261 · Containers

Detection of container image build activity directly on the host using Docker or Kubernetes APIs. Defenders may observe Docker build requests, anomalous Dockerfile instructions (such as downloading code from unknown IPs), or creation of new images followed by immediate deployment. This behavior chain typically consists of an unexpected image creation event correlated with outbound network communication to non-standard or untrusted destinations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Image CreationDC0015	docker:daemon	docker build or POST /build API request
Network Connection CreationDC0082	NSM:Flow	outbound connections from host during or immediately after image build

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RegistryAllowList	Defines trusted registries for image pulls/builds. Builds referencing unapproved registries may indicate adversary behavior.
NewImageThreshold	Threshold for number of new custom images created in a given time window. Exceeding this threshold may indicate malicious builds.
TimeWindow	Defines correlation window (e.g., 5m) between suspicious build activity and subsequent network traffic anomalies.

Tests1Executorssh 1Need elevation0 of 1Have prerequisites1Have cleanup1Platformscontainers

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Build Image On Host	containers	sh	—	2	Yes
Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image. Attack command docker build -t t1612 $PathtoAtomicsFolder/T1612/src/ docker run --name t1612_container --rm -d -t t1612 docker exec t1612_container ./test.sh Cleanup command docker stop t1612_container docker rmi -f t1612 Prerequisite Verify docker is installed. Check which docker Satisfy if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi Prerequisite Verify docker service is running. Check sudo systemctl status docker --no-pager Satisfy sudo systemctl start docker GUID394cc3f1-461e-4d2d-93b9-735eb345d9fd

Tests from Atomic Red Team (MIT licence) · technique definition

Build Image on Host detections T1612

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs