t1612-build-image-on-host

name	T1612_build-image-on-host
description	Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1612","defense-evasion","containers"]
technique_id	T1612
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Containers"]
mitre_url	https://attack.mitre.org/techniques/T1612
tech_stack	["containers"]
cwe_ids	["CWE-693"]
chains_with	[]
prerequisites	[]
severity_boost	{}

T1612 Build Image on Host

High-Level Description

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.

An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize Deploy Container using that custom image. If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Containers

What to Check

• Identify if Build Image on Host technique is applicable to target environment
• Check Containers systems for indicators of Build Image on Host
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Build Image On Host

Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image.

Supported Platforms: containers

docker build -t t1612  $PathtoAtomicsFolder/T1612/src/
docker run --name t1612_container --rm -d -t t1612
docker exec t1612_container ./test.sh

Dependencies:

• Verify docker is installed.
• Verify docker service is running.