Suspicious docker image download from an unusual repository

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	Kubernetes - AGENT, Containers
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution: Malicious Image (T1204.003)
Severity	Informational

Description

The agent has pulled a docker image from a repository for the first time.

Attacker's Goals

Adversaries may rely on a user running a malicious image to facilitate execution.

Investigative actions

• Scan the docker image that was pulled.
• Check the repository designation.
• Check on which other agents the docker image is being used.

Variations

Suspicious docker image download from an unrecognized registry

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution: Malicious Image (T1204.003)
Severity	Low

Description

The agent has pulled a docker image from a registry that has never been used in the organization.

Attacker's Goals

Adversaries may rely on a user running a malicious image to facilitate execution.

Investigative actions

• Scan the docker image that was pulled.
• Check the repository designation.
• Check on which other agents the docker image is being used.

Suspicious docker image download from an unrecognized repository

Synopsis

Field	Value
ATT&CK Tactic	Execution (TA0002)
ATT&CK Technique	User Execution: Malicious Image (T1204.003)
Severity	Low

Description

The agent has pulled a docker image from a repository that has never been used in the organization.

Attacker's Goals

Adversaries may rely on a user running a malicious image to facilitate execution.

Investigative actions

• Scan the docker image that was pulled.
• Check the repository designation.
• Check on which other agents the docker image is being used.