cyberstrikeus T1612 Build Image on Host
High-Level Description
Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.
An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they may utilize Deploy Container using that custom image. If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image. If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.
Kill Chain Phase
- Defense Evasion (TA0005)
Platforms: Containers
What to Check
- Identify if Build Image on Host technique is applicable to target environment
- Check Containers systems for indicators of Build Image on Host
- Verify mitigations are bypassed or absent (4 known mitigations)
- Assess detection coverage (1 detection strategies)
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Build Image On Host
Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry. An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image.
Supported Platforms: containers
docker build -t t1612 $PathtoAtomicsFolder/T1612/src/
docker run --name t1612_container --rm -d -t t1612
docker exec t1612_container ./test.sh
Dependencies:
- Verify docker is installed.
- Verify docker service is running.
Manual Testing
If Atomic Red Team tests are not applicable, manually verify the technique by:
Identify Attack Surface: Determine if the target environment is susceptible to Build Image on Host by examining the target platforms (Containers).
Assess Existing Defenses: Review whether mitigations for T1612 are in place. If defenses are absent or misconfigured, this technique may be exploitable.
Execute Test: Use tools and methods described in the MITRE ATT&CK page and external references below.
Remediation Guide
M1035 Limit Access to Resource Over Network
Limit communications with the container service to local Unix sockets or remote access via SSH. Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API on port 2375. Instead, communicate with the Docker API over TLS on port 2376.
M1026 Privileged Account Management
Ensure containers are not running as root by default. In Kubernetes environments, consider defining Pod Security Standards that prevent pods from running privileged containers.
M1030 Network Segmentation
Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.
M1047 Audit
Audit images deployed within the environment to ensure they do not contain any malicious components.
Detection
Detection Strategy for Build Image on Host
Risk Assessment
| Finding | Severity | Impact |
|---|---|---|
| Build Image on Host technique applicable | Low | Defense Evasion |
CWE Categories
| CWE ID | Title |
|---|---|
| CWE-693 | Protection Mechanism Failure |