T1612 — Build Image on Host

Tactic: Stealth · Platforms: Containers

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or…

Sigma detection rules (1)

T1612 Build Image on Host

title: T1612 Build Image on Host
id: 56439018-0d55-411f-bb3b-d68c03ede7f4
description: 'Detection Strategy for Build Image on Host. (Data Component: Image Creation; baseline tier: fallback.) Tune using: RegistryAllowList, NewImageThreshold, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1612
author: Shahrukh Khan
date: 2026-05-05
license: MIT
tags:
  - attack.stealth
  - attack.t1612

logsource:
  product: docker
  service: daemon

detection:
  selection:
    Type: 'image'
    Action: 'build'
  filter_allowed:
    Actor.Attributes.image|startswith: 'registry.trusted.corp/'

  condition: selection and not filter_allowed

falsepositives:
  - Developers legitimately building local images on the host as part of normal iterative development.

level: medium

Explore