T1525 — Implant Internal Image

Tactic: Persistence · Platforms: IaaS, Containers

Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker…

Sigma detection rules (2)

T1525 Implant Internal Image

title: T1525 Implant Internal Image
id: 99f5bb80-b0c2-493b-8218-22e84803cde8
description: 'Detection Strategy for T1525 – Implant Internal Image. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: IAMRole, ImageTagRegex, LaunchWindow.'
references:
  - https://attack.mitre.org/techniques/T1525
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
  - attack.persistence
  - attack.t1525

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventSource: 'ec2.amazonaws.com'
    eventName:
      - 'CreateImage'
      - 'RegisterImage'
      - 'CopyImage'

  condition: selection

falsepositives:
  - Automated golden-image pipelines and backup tooling routinely create and register AMIs on a schedule.

level: high

T1525 Implant Internal Image

title: T1525 Implant Internal Image
id: 0f9eb85a-802d-4918-b35b-8c0dd34e03e7
description: 'Detection Strategy for T1525 – Implant Internal Image. (Data Component: Image Creation; baseline tier: fallback.) Tune using: TimeWindow, UserContext, RegistryNameRegex.'
references:
  - https://attack.mitre.org/techniques/T1525
author: Shahrukh Khan
date: 2026-05-19
license: MIT
tags:
  - attack.persistence
  - attack.t1525

logsource:
  product: docker
  service: daemon

detection:
  selection:
    Type: 'image'
    Action:
      - 'tag'
      - 'push'
  filter_known:
    Actor.Attributes.name|contains: 'internal-registry.trusted.corp'

  condition: selection and not filter_known

falsepositives:
  - Normal CI pipeline builds tagging and pushing new images to the approved internal registry during release.

level: medium

Explore