Detection of Unauthorized Container Image Uploads to AWS ECR

This brief focuses on identifying anomalous container image management activity within Amazon Web Services (AWS) environments, specifically targeting unauthorized pushes to the AWS Elastic Container Registry (ECR). Adversaries or malicious insiders may attempt to push malicious or backdoored container images into a registry to facilitate downstream execution, persistence, or lateral movement within a containerized CI/CD pipeline or orchestration environment. By monitoring AWS CloudTrail logs via Amazon Security Lake, security teams can isolate instances where the 'PutImage' API operation is invoked by identities not previously categorized as authorized developers or automated build systems. This approach provides visibility into potential supply chain compromise attempts.

Impact

Successful exploitation could result in the deployment of compromised or malicious container images across an organization's infrastructure. Unauthorized images may contain backdoors, malware, or hardcoded credentials, leading to full container escapes, data exfiltration, or secondary access within the cloud environment. Organizations leveraging automated deployment pipelines are particularly vulnerable to these malicious images being automatically promoted to production clusters.

Recommendation

• Maintain and regularly update an allowlist of authorized IAM entities (users, roles, and service accounts) permitted to push images to production ECR repositories.
• Ingest AWS CloudTrail logs via Amazon Security Lake into your SIEM to monitor for 'PutImage' API activity.
• Establish alerting thresholds for 'PutImage' events originating from source IP addresses or user agents outside of known developer workstations or CI/CD runner environments.
• Implement and enforce ECR image scanning to detect known vulnerabilities in images before they are deployed to orchestration platforms.