AN0691 Analytic 0691

Linux · attack.mitre.org · ATT&CK Enterprise v19.2

<p>CONTAINERS (Docker/K8s/containerd): A user pulls an untrusted image from a public/unknown registry and then creates/starts a container from that image. Shortly after start, the container spawns unexpected utilities (e.g., curl/wget/bash/python), or makes outbound network connections atypical for the namespace/workload. The analytic correlates Image Creation/Download → Container Creation → Container Start → Command Execution/Network activity within a short window and with a consistent image digest.</p>

Detects: T1204.003 Malicious Image
Part of: DET0248 User Execution – Malicious Image (containers & IaaS) – pull/run → start → anomalous behavior (T1204.003)

Log sources and channels

Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.

Log source	Channel	Data component
containerd:events	`Image pull from untrusted registry (name NOT IN allowlist) or new digest never seen before`	DC0015 Image Creation
kubernetes:audit	`create: Pod/Container created with image tag 'latest' or mutable tag; imagePullPolicy=Always; noDigest=true`	DC0072 Container Creation
kubernetes:events	`start: ContainerStarted or Pulling image → Started container`	DC0077 Container Start
auditd:SYSCALL	`execve: Process in container namespace executes curl\|wget\|bash\|sh\|python\|nc with outbound args`	DC0064 Command Execution
NSM:Flow	`New egress from container IP/namespace to Internet or non-approved CIDRs/ASNs`	DC0085 Network Traffic Content

Mutable elements

Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.

Field	Description
`ImageRegistryAllowList`	Approved registries/namespaces (e.g., ECR/GCR/ACR org repos).
`TimeWindow`	Correlation window from image pull to container activity (e.g., ≤15m).
`SuspiciousBinaries`	Executables treated as high-risk when run in app containers (bash, sh, curl, wget, nc, powershell for Windows containers).
`NamespaceScope`	K8s namespaces that should never pull from Internet or run mutable tags.
`OutboundCIDRBlockList`	Destination networks/domains that should not be contacted by containers.