AWS GetAuthorizationToken
Retrieves an ECR authorization token for Docker image operations, seen in container escape and lateral movement chains.
Tag: ECR
ECR
All events with tag ECR.
AWS PutImage
Registers a container image manifest in ECR (the layer blobs are uploaded separately), finalizing an image push and potentially introducing a backdoored image into the pipeline.