Techniques › T1204.003 › AN0692
AN0692 Analytic 0692
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>IAAS (Cloud images/VMs): A new VM/instance is launched from a non-approved or newly-seen image (AMI/GCP Image/Azure Image). On first boot, cloud-init/user-data or embedded agents download code, spawn system utilities, or open outbound C2/mining traffic. The analytic correlates Instance/Image Creation → Instance Start → in-guest Process/Command Execution and/or anomalous network traffic.</p>
- Detects
- T1204.003 Malicious Image
- Part of
- DET0248 User Execution – Malicious Image (containers & IaaS) – pull/run → start → anomalous behavior (T1204.003)
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | RunInstances | DC0080 Instance Start |
| azure:activity | Microsoft.Compute/virtualMachines/write: imageReference publisher NOT IN allowlist OR plan is new/unknown | DC0076 Instance Creation |
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| NSM:Flow | New VM egress to crypto-mining pools or non-approved Internet ranges within minutes of boot | DC0085 Network Traffic Content |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
ApprovedImageCatalog | Set of golden images/owners and digest/IDs allowed to launch. |
UserDataInspection | Whether to alert when userData/cloud-init contains exec or download directives. |
FirstBootWindow | Time after start considered first-boot (e.g., ≤30m) for correlation. |
VMTagScope | Restrict detection to prod or internet-facing subnets to reduce noise. |