AWS PutImage
Registers a container image manifest in ECR (the layer blobs are uploaded separately), finalizing an image push and potentially introducing a backdoored image into the pipeline.
T1525: Implant Internal Image
T1525: Implant Internal Image
Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment. Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker...
View on MITRE ATT&CK →