Techniques › T1525 › AN0947
AN0947 Analytic 0947
IaaS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Creation or modification of cloud virtual machine images (AMIs, custom images) with persistence mechanisms, followed by infrastructure provisioning that uses these implanted images.</p>
- Detects
- T1525 Implant Internal Image
- Part of
- DET0334 Detection Strategy for T1525 – Implant Internal Image
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| AWS:CloudTrail | RegisterImage | DC0015 Image Creation |
| AWS:CloudTrail | ModifyImageAttribute | DC0036 Image Modification |
| AWS:CloudTrail | RunInstances | DC0080 Instance Start |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
IAMRole | Roles that are allowed to register and modify images should be scoped narrowly. |
ImageTagRegex | Expected tags or naming patterns for images (e.g., 'golden-image', 'base-image'). |
LaunchWindow | Time interval between image creation and instance launch. |