T1204.003 — Malicious Image

Tactic: Execution · Platforms: IaaS, Containers

Adversaries may rely on a user running a malicious image to facilitate execution. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored. Backdoored images may be uploaded…

Sub-technique of User Execution (T1204).

Sigma detection rules (2)

T1204.003 User Execution: Malicious Image

title: "T1204.003 User Execution: Malicious Image"
id: 148fa841-63f7-4491-9ead-826aeb4d365d
description: 'Detects Docker CLI/daemon invocations (run/pull/create) on Windows hosts, the closest Windows-observable proxy for a user or automation pulling and running a potentially backdoored container image; tampering of the image content itself prior to pull is not observable from the host. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: ApprovedImageCatalog, UserDataInspection, FirstBootWindow, VMTagScope.'
references:
  - https://attack.mitre.org/techniques/T1204/003
author: Shahrukh Khan
date: 2026-04-24
license: MIT
tags:
  - attack.execution
  - attack.t1204.003

logsource:
  category: process_creation
  product: windows

detection:
  selection_image:
    Image|endswith:
      - '\docker.exe'
      - '\dockerd.exe'
  selection_action:
    CommandLine|contains:
      - ' run '
      - ' pull '
      - ' create '
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection_image and selection_action and not filter_system_account

falsepositives:
  - Routine developer or CI/CD container pulls/runs from approved registries — maintain ApprovedImageCatalog to reduce noise.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account.

level: medium

T1204.003 User Execution: Malicious Image

title: "T1204.003 User Execution: Malicious Image"
id: d032e81a-54bc-46a5-a9bf-2f200c7d9cfc
description: 'User Execution - Malicious Image (containers & IaaS) - pull/run -> start -> anomalous behavior (T1204.003). Fixed a tautology: the prior exclusion checked argv for the literal unfilled string "ImageRegistryAllowList_PLACEHOLDER", which never occurs in real command lines, so the rule fired on every container run/create regardless of image source. Replaced with Sigmas native %placeholder%/expand mechanism so the allow-list is resolved from actual deployment config at conversion time, and checks multiple argv positions since the image references position shifts with preceding flags. Tune using: ImageRegistryAllowList, TimeWindow, SuspiciousBinaries, NamespaceScope, OutboundCIDRBlockList.'
references:
  - https://attack.mitre.org/techniques/T1204/003
author: Shahrukh Khan
date: 2026-01-26
license: MIT
tags:
  - attack.execution
  - attack.t1204.003

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/docker'
      - '/kubectl'
      - '/crictl'
    a1|contains:
      - 'run'
      - 'create'
  selection_trusted_image:
    - a2|contains|expand: '%ImageRegistryAllowList%'
    - a3|contains|expand: '%ImageRegistryAllowList%'
    - a4|contains|expand: '%ImageRegistryAllowList%'
    - a5|contains|expand: '%ImageRegistryAllowList%'

  condition: selection and not selection_trusted_image

falsepositives:
  - Routine, sanctioned container deployments from an approved registry once ImageRegistryAllowList is actually populated for the environment; auditd cannot inspect the pulled image's actual content/layers, so this remains only a coarse proxy for 'a container was launched from an untrusted reference', not confirmation of a malicious image.

level: medium

Related sub-techniques

Explore