Ctrl+K

T1612 - Build Image on Host

T1612 - Build Image on Host#

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.(Citation: Docker Build Image)

An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize Deploy Container using that custom image.(Citation: Aqua Build Images on Hosts)(Citation: Aqua Security Cloud Native Threat Report June 2021) If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.

Atomic Tests#

Atomic Test #1 - Build Image On Host#

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image. Supported Platforms: containers

Dependencies: Run with sh!#

Description: Verify docker is installed.#
Check Prereq Commands:#
which docker
Get Prereq Commands:#
if [ "" == "`which docker`" ]; then echo "Docker Not Found"; if [ -n "`which apt-get`" ]; then sudo apt-get -y install docker ; elif [ -n "`which yum`" ]; then sudo yum -y install docker ; fi ; else echo "Docker installed"; fi
Description: Verify docker service is running.#
Check Prereq Commands:#
sudo systemctl status docker  --no-pager
Get Prereq Commands:#
sudo systemctl start docker

Invoke-AtomicTest T1612 -TestNumbers 1 -GetPreReqs

Attack Commands: Run with sh#

docker build -t t1612  $PathtoAtomicsFolder/T1612/src/
docker run --name t1612_container  -d -t t1612
docker exec t1612_container ./test.sh```

Invoke-AtomicTest T1612 -TestNumbers 1

Cleanup:#

docker stop t1612_container
docker rmi -f t1612```

Invoke-AtomicTest T1612 -TestNumbers 1 -Cleanup

Detection#

Monitor for unexpected Docker image build requests to the Docker daemon on hosts in the environment. Additionally monitor for subsequent network communication with anomalous IPs that have never been seen before in the environment that indicate the download of malicious code.

Contents