Suspicious AWS ECR Container Upload Outside Business Hours

This alert focuses on detecting potentially malicious uploads to AWS Elastic Container Registry (ECR) that occur outside of typical business hours. While not inherently malicious, such activity can signify unauthorized access or insider threats attempting to deploy compromised container images. This detection is designed to identify anomalous behavior that warrants further investigation, especially in environments with strict container deployment policies. This detection uses the aws_ecr_container_upload_outside_business_hours.yml file from the Splunk security content repository.

Attack Chain

1. An attacker gains unauthorized access to AWS credentials through compromised credentials, exposed keys, or other means.
2. The attacker uses these credentials to authenticate to the AWS environment.
3. The attacker creates or modifies a Docker image to include malicious software, backdoors, or other unwanted components.
4. The attacker uploads the malicious Docker image to an AWS ECR repository outside of normal business hours. This is done using the docker push command or AWS CLI.
5. A deployment pipeline or manual deployment process pulls the newly uploaded (malicious) container image from ECR.
6. The compromised container is deployed into a production or development environment.
7. The malicious code within the container executes, potentially leading to data exfiltration, privilege escalation, or denial of service.

Impact

A successful attack could lead to the deployment of compromised containers in the AWS environment. This can result in data breaches, service disruptions, or unauthorized access to sensitive resources. The impact is highly dependent on the nature of the malicious code injected into the container image. Early detection of unusual ECR upload activity outside business hours can help prevent or mitigate the impact of such attacks.